2.2.2. CloudTrail: API Logging and Analysis
💡 First Principle: Every action taken in AWS — whether by a human, a service, or a Lambda function — is an API call. CloudTrail records every one of those calls. It answers the critical incident question: "Who did what, to which resource, from where, and when?"
Without CloudTrail, you couldn't answer "Who deleted the production S3 bucket?" or "Which IAM role made that change at 3 AM?" CloudTrail makes AWS infrastructure auditable.
Event Types:
| Event Type | What It Captures | Default? |
|---|---|---|
| Management Events | Control plane operations (CreateInstance, DeleteBucket, PutPolicy) | ✅ Yes |
| Data Events | Data plane operations (S3 GetObject/PutObject, Lambda Invoke, DynamoDB PutItem) | ❌ No (extra cost) |
| Insights Events | Unusual API activity patterns (anomaly detection) | ❌ No (extra cost) |
Event history in the console shows the past 90 days of management events in each Region with no setup. To keep events longer, create a trail that delivers them to an S3 bucket.
Trail Configuration:
A trail is the configuration that delivers events to an S3 bucket (and optionally CloudWatch Logs and EventBridge). Key decisions:
- Single-region vs. multi-region: Best practice is to create a multi-region trail so you capture activity in all regions, including regions you don't actively use (attackers may exploit unused regions)
- Organization trail: Configured in the management account, automatically applies to all member accounts — ensures you can't "forget" to enable CloudTrail in a new account
- Log file validation: CloudTrail can compute a SHA-256 digest of each log file. If someone tampers with or deletes log files, validation will fail — critical for compliance
CloudTrail Lake is a managed data lake for CloudTrail events that allows SQL-based querying without first exporting to S3 and using Athena. Use CloudTrail Lake when you need quick, interactive analysis of API activity at scale. Lake queries only the events in its event data stores (collected after the store is created, or copied in from a trail). For log files a trail has already delivered to S3, Amazon Athena queries them in place: create a CloudTrail table over the bucket (partition projection keeps queries fast) and filter on fields such as eventName, eventTime or userIdentity. CloudTrail Lake stopped accepting new customers on May 31, 2026; existing customers can keep using it, and for new setups AWS recommends Amazon CloudWatch, which can ingest CloudTrail events and query them.
⚠️ Exam Trap: CloudTrail delivers log files to S3 with a delay of up to 15 minutes (typically 5–10 minutes). If you need real-time alerting on API activity, configure the trail to deliver to CloudWatch Logs and set a metric filter there, or use EventBridge to subscribe to CloudTrail events directly.
Reflection Question: An IAM user's access key was leaked. You need to find every AWS API call made by that access key in the last 24 hours. What CloudTrail feature or service do you use, and what query would you run?
