AWS CloudTrail is a web service that records AWS API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service.
With CloudTrail, you can get a history of AWS API calls for your account, including API calls made via the AWS Management Console, AWS SDKs, command line tools, and higher-level AWS services (such as AWS CloudFormation). The AWS API call history produced by CloudTrail enables security analysis, resource change tracking, and compliance auditing.
CloudTrail provides increased visibility into your user activity by recording AWS API calls. You can answer questions such as, what actions did a given user take over a given time period? For a given resource, which user has taken actions on it over a given time period? What is the source IP address of a given activity? Which activities failed due to inadequate permissions?
CloudTrail uses Amazon S3 for log file storage and delivery, so log files are stored durably and inexpensively. You can use Amazon S3 lifecycle configuration rules to further reduce storage costs. For example, you can define rules to automatically delete old log files or archive them to Amazon Glacier for additional savings.
CloudTrail is a fully managed service; you simply turn on CloudTrail for your account using the AWS Management Console, the Command Line Interface, or the CloudTrail SDK and start receiving CloudTrail log files in the Amazon Simple Storage Service (Amazon S3) bucket that you specify.
CloudTrail continuously transports events from AWS services using a highly available and fault tolerant processing pipeline.
CloudTrail typically delivers events within 15 minutes of the API call.
CloudTrail can be configured to aggregate log files across multiple accounts and regions so that log files are delivered to a single bucket. Please refer to the of the AWS CloudTrail User Guide for detailed instructions.
CloudTrail can be configured to publish a notification for each log file delivered, thus enabling you to automatically take action upon log file delivery. CloudTrail uses the Amazon Simple Notification Service (SNS) for notifications.
Multiple partners including AlertLogic, Boundary, Loggly, Splunk and Sumologic offer integrated solutions to analyze CloudTrail log files. These solutions include features like change tracking, troubleshooting, and security analysis. For more information, see the CloudTrail partners section.
Currently, CloudTrail supports the following services:
- Amazon Elastic Compute Cloud (Amazon EC2)
- Amazon Elastic Block Store (Amazon EBS)
- Amazon Redshift
- Amazon Relational Database Service (Amazon RDS)
- Amazon Virtual Private Cloud (Amazon VPC)
- AWS CloudTrail
- AWS Identity and Access Management (AWS IAM)
- AWS Security Token Service (AWS STS)
Currently, CloudTrail supports the following regions:
- US East (Northern Virginia)
- US West (Oregon)
CloudTrail will support additional AWS services and regions in the coming months.
You can use the AWS API call history produced by CloudTrail as an input into log management and analysis solutions to perform security analysis and to detect user behavior patterns.
You can use the AWS API call history produced by CloudTrail to track changes to AWS resources, including creation, modification, and deletion of AWS resources such as Amazon EC2 instances, Amazon VPC security groups and Amazon EBS volumes.
You can use the AWS API call history produced by CloudTrail to troubleshoot operational issues. For example, you can quickly identify the most recent changes made to resources in your environment.