Q: What is AWS CloudTrail?
AWS CloudTrail enables auditing, security monitoring, and operational troubleshooting by tracking user activity and API usage. CloudTrail logs, continuously monitors, and retains account activity related to actions across your AWS infrastructure, giving you control over storage, analysis, and remediation actions.
Q: What are the benefits of CloudTrail?
CloudTrail helps you prove compliance, improve security posture, and consolidate activity records across regions and accounts. CloudTrail provides visibility into user activity by recording actions taken on your account. CloudTrail records important information about each action, including who made the request, the services used, the actions performed, parameters for the actions, and the response elements returned by the AWS service. This information helps you track changes made to your AWS resources and troubleshoot operational issues. CloudTrail makes it easier to ensure compliance with internal policies and regulatory standards. For more details, refer to the AWS compliance white paper “Security at scale: Logging in AWS”.
Q: Who should use CloudTrail?
You should use CloudTrail if you need to audit activity, monitor security, or troubleshoot operational issues.
Q: If I am a new AWS customer or existing AWS customer and don’t have CloudTrail setup, do I need to enable or set up anything to view my account activity?
No, nothing is required to begin viewing your account activity. You can visit the AWS CloudTrail console or AWS CLI and begin viewing up to the past 90 days of account activity.
Q: Does the CloudTrail Event History show all account activity within my account?
AWS CloudTrail will only show the results of the CloudTrail Event History for the current region you are viewing for the last 90 days, and supports a range of AWS services. These events are limited to management events with create, modify, and delete API calls and account activity. For a complete record of account activity, including all management events, data events, and read-only activity, you must configure a CloudTrail trail.
Q: What search filters can I use to view my account activity?
You can specify Time range and one of the following attributes: Event name, User name, Resource name, Event source, Event ID, and Resource type.
Q: Can I use the lookup-events CLI command even if I don’t have a trail configured?
Yes, you can visit the CloudTrail console or use the CloudTrail API/CLI and begin viewing the past 90 days of account activity.
Q: What additional CloudTrail features are available after creating a trail?
Set up a CloudTrail trail to deliver your CloudTrail events to Amazon S3, Amazon CloudWatch Logs, and Amazon CloudWatch Events. This enables you to leverage features to help archive, analyze, and respond to changes in your AWS resources.
Q: Can I restrict user access from viewing the CloudTrail Event History?
Yes, CloudTrail integrates with AWS Identity and Access Management (IAM), which allows you to control access to CloudTrail and to other AWS resources that CloudTrail requires, including the ability to restrict permissions to view and search account activity. Remove the "cloudtrail:LookupEvents" from the Users IAM policy to prevent that IAM user from viewing account activity.
Q: Is there any cost associated with CloudTrail Event History being enabled on my account upon creation?
There is no cost for viewing or searching account activity with CloudTrail Event History.
Q: Can I turn CloudTrail Event History off for my account?
For any CloudTrail trails created, you can stop logging or delete the trails. This will also stop account activity delivery to the S3 bucket you designated as part of your trail configuration, as well as delivery to CloudWatch Logs if configured. Account activity for the past 90 days will still be collected and visible within the CloudTrail console and through the AWS command-line interface (CLI).
Services and region support
Q: What services are supported by CloudTrail?
AWS CloudTrail records account activity and service events from most AWS services. For the list of supported services, see CloudTrail Supported Services in the CloudTrail User Guide.
Q: Are API calls made from the AWS Management Console recorded?
Yes. CloudTrail records API calls made from any client. The AWS Management Console, AWS software development kits (SDKs), command line tools, and higher-level AWS services call AWS APIs, so these calls are recorded.
Q: Where are my log files stored and processed before they are delivered to my Amazon S3 bucket?
Activity information for services with regional end points (EC2, RDS etc.) is captured and processed in the same region as the action is made, and delivered to the region associated with your Amazon S3 bucket. Activity information for services with single endpoints such as IAM and AWS Security Token Service (STS) is captured in the region where the endpoint is located, processed in the region where the CloudTrail trail is configured, and delivered to the region associated with your Amazon S3 bucket.
Applying a trail to all regions
Q: What does it mean to apply a trail to all regions?
Applying a trail to all AWS Regions refers to creating a trail that will record AWS account activity across all regions in which your data is stored. This setting also applies to any new regions added. For more details on regions and partitions, refer to the Amazon Resource Names and AWS Service Namespaces page.
Q: What are the benefits of applying a trail to all regions?
You can create and manage a trail across all regions in the partition in one API call or a few clicks. You will receive a record of account activity made in your AWS account across all regions to one Amazon S3 bucket or CloudWatch logs group. When AWS launches a new region, you will receive the log files containing event history for the new region without taking any action.
Q: How do I apply a trail to all regions?
In the CloudTrail console, you select yes to apply to all regions in the trail configuration page. If you are using the SDKs or AWS CLI, you set the IsMultiRegionTrail to true.
Q: What happens when I apply a trail to all regions?
Once you apply a trail in all regions, CloudTrail will create a new trail by replicating the trail configuration. CloudTrail will record and process the log files in each region and deliver log files containing account activity across all AWS Regions to a single Amazon S3 bucket and a single CloudWatch Logs log group. If you specified an optional Amazon Simple Notification Service (SNS) topic, CloudTrail will deliver SNS notifications for all log files delivered to a single SNS topic.
Q: Can I apply an existing trail to all regions?
Yes. You can apply an existing trail to all regions. When you apply an existing trail to all regions, CloudTrail will create a new trail for you in all regions. If you previously created trails in other regions, you can view, edit and delete those trails from the CloudTrail console.
Q: How long will it take for CloudTrail to replicate the trail configuration to all regions?
Typically, it will take less than 30 seconds to replicate the trail configuration to all regions.
Q: How many trails can I create in an AWS region?
You can create up to five trails in an AWS region. A trail that applies to all regions exists in each region and is counted as one trail in each region.
Q: What is the benefit of creating multiple trails in an AWS region?
With multiple trails, different stakeholders such as security administrators, software developers and IT auditors can create and manage their own trails. For example, a security administrator can create a trail that applies to all regions and configure encryption using one Amazon Key Management Service (KMS) key. A developer can create a trail that applies to one region for troubleshooting operational issues.
Q: Does CloudTrail support resource-level permissions?
Yes. Using resource-level permissions, you can write granular access control policies to allow or deny access to specific users for a particular trail. For more details, go to CloudTrail documentation.
Security and expiration
Q: How can I secure my CloudTrail log files?
By default, CloudTrail log files are encrypted using Amazon S3 Server Side Encryption (SSE) and placed into your S3 bucket. You can control access to log files by applying IAM or S3 bucket policies. You can add an additional layer of security by enabling S3 Multi Factor Authentication (MFA) Delete on your S3 bucket. For more details on creating and updating a trail, see the CloudTrail documentation.
Q: Where can I download a sample S3 bucket policy and an SNS topic policy?
You can download a sample S3 bucket policy and an SNS topic policy from CloudTrail S3 bucket. You need to update the sample policies with your information before you apply them to your S3 bucket or SNS topic.
Q: How long can I store my activity log files?
You control the retention policies for your CloudTrail log files. By default, log files are stored indefinitely. You can use Amazon S3 object lifecycle management rules to define your own retention policy. For example, you may want to delete old log files or archive them to Amazon Glacier.
Event payload, Timeliness, and Delivery Frequency
Q: What information is available in an event?
An event contains information about the associated activity: who made the request, the services used, the actions performed, and parameters for the action, and the response elements returned by the AWS service. For more details, see the CloudTrail Event Reference section of the user guide.
Q: How long does it take CloudTrail to deliver an event for an API call?
Typically, CloudTrail delivers an event within 15 minutes of the API call.
Q: How often will CloudTrail deliver log files to my Amazon S3 bucket?
CloudTrail delivers log files to your Amazon S3 bucket approximately every five minutes. CloudTrail does not deliver log files if no API calls are made on your account.
Q: Can I be notified when new log files are delivered to my Amazon S3 bucket?
Yes. You can turn on Amazon SNS notifications to take immediate action on delivery of new log files.
Q: What happens if CloudTrail is turned on for my account but my Amazon S3 bucket is not configured with the correct policy?
CloudTrail log files are delivered in accordance with the S3 bucket policies that you have in place. If the bucket policies are misconfigured, CloudTrail will not be able to deliver log files.
Q: What are data events?
Data events provide insights into the resource (“data plane”) operations performed on or within the resource itself. Data events are often high volume activities and include operations such as Amazon S3 object level APIs and Lambda function invoke API. Data events are disabled by default when you configure a trail. To record CloudTrail data events, you must explicitly add the supported resources or resource types you want to collect activity on. Unlike management events, data events incur additional costs. For more information, see CloudTrail pricing.
Q: How can I consume data events?
Data events that are recorded by AWS CloudTrail are delivered to Amazon S3, similar to management events. Once enabled, these events are also available in Amazon CloudWatch Events.
Q: What are Amazon S3 data events? How do I record them?
Amazon S3 data events represent API activity on Amazon S3 Objects. To get CloudTrail to record these actions, you specify a S3 bucket in the data events section when creating a new trail or modifying an existing one. Any API actions on the objects within the specified S3 bucket are recorded by CloudTrail.
Q: What are AWS Lambda data events? How do I record them?
AWS Lambda data events record execution activity of your Lambda functions. With Lambda data events, you can get details on Lambda function executions, such as the IAM user or service that made the Invoke API call, when the call was made, and which function was executed. All Lambda data events are delivered to an Amazon S3 bucket and Amazon CloudWatch Events. You can turn on logging for AWS Lambda data events using the AWS CLI or AWS CloudTrail console and select which Lambda functions get logged by creating a new trail or editing an existing trail.
Q: What are CloudTrail Insights events?
AWS CloudTrail Insights events help customers identify unusual activity in their AWS accounts such as spikes in resource provisioning, bursts of AWS Identity and Access Management (IAM) actions, or gaps in periodic maintenance activity. CloudTrail Insights uses machine learning (ML) models that continuously monitor CloudTrail write management events for abnormal activity.
When abnormal activity is detected, CloudTrail Insights events are shown in the console, and delivered to Amazon CloudWatch Events, your Amazon S3 bucket, and optionally to Amazon CloudWatch Logs group. This makes it easy to create alerts and integrate with existing event management and workflow systems.
Q: What type of activity does AWS CloudTrail Insights help identify?
CloudTrail Insights detects unusual activity by analyzing CloudTrail write management events within an AWS account and a region. An unusual or abnormal event is defined as the volume of AWS API calls that deviates from what is expected from a previously established operating pattern or baseline. CloudTrail Insights adapts to changes in your normal operating patterns by taking into account time-based trends in your API calls and applying adaptive baselines as workloads change.
CloudTrail Insights can help you detect misbehaving script or applications. It's not uncommon to hear about a developer changing a script or application that begins a repeating loop or makes a large number of calls to unintended resources such as databases, data stores, or other functions. Often this behavior isn't noticed until the month-end billing cycle when costs have increased unexpectedly or an actual outage or disruption occurs. CloudTrail Insights events can make you aware of these changes in your AWS account so that you can take corrective action quickly.
Q: How does CloudTrail Insights work with other AWS services that use anomaly detection?
CloudTrail Insights can help you identify unusual operational activity in your AWS accounts that enables you to address operational issues, minimizing operational and business impact. Amazon GuardDuty focuses on improving security in your account, providing threat detection by monitoring account activity. Amazon Macie is designed to improve data protection in your account by discovering, classifying, and protecting sensitive data. These services provide complementary protections against different types of problems which could arise in your account.
Q: Do I need to have AWS CloudTrail set up in order for CloudTrail Insights to work?
Yes. CloudTrail Insights events are configured on individual trails, so you must have at least one trail set up. When you turn on CloudTrail Insights events for a trail, CloudTrail starts monitoring the write management events captured by that trail for unusual patterns. If CloudTrail Insights detects unusual activity, a CloudTrail Insights event is logged to the delivery destination specified in the trail definition.
Q: What kinds of events does CloudTrail Insights monitor?
CloudTrail Insights tracks unusual activity for write management APIs.
Q: How do I get started?
You can enable CloudTrail Insights events on individual trails in your account by using the console, the CLI, or the SDK. You can also enable CloudTrail Insights events across your organization by using an Organizational trail configured in your AWS Organizations master account. You can turn on CloudTrail Insights events by choosing the radio button in your trail definition.
Q: Why should I use AWS CloudTrail Lake?
CloudTrail Lake allows you to examine incidents by querying all actions logged by CloudTrail. It simplifies incident logging by helping to remove operational dependencies and provides tools that can help reduce your reliance on complex data process pipelines that span across teams. CloudTrail Lake does not require you to move and ingest CloudTrail logs elsewhere, which helps maintain data fidelity and eliminates dealing with low-rate limits that throttle your logs. It also provides near real-time latencies as it is optimized to process high-volume structured logs, making them available for incident investigation. In addition, CloudTrail Lake provides a familiar, multi-attribute query experience with SQL and is capable of scheduling and handling multiple concurrent queries.
Q: How does this feature relate to and work with other AWS services?
AWS CloudTrail is the canonical source of logs for user activity and API usage across AWS services. You can leverage CloudTrail Lake to examine activity across all AWS services once the logs are available in CloudTrail. You can query and analyze user activity and impacted resources, and use that data to address issues such as identifying bad actors and baselining permissions.
Q: If I've used trails before, can I bring existing CloudTrail logs into my existing or new CloudTrail Lake event data store?
Yes. The CloudTrail Lake import capability supports copying CloudTrail logs from an Amazon S3 bucket that stores logs from across multiple accounts (from an organization trail) and multiple AWS Regions. You can also import logs from individual accounts and single-region trails. The import capability also lets you specify an import date range, so that you only import the subset of logs that are needed for long-term storage and analysis in Lake. After you've consolidated your logs, you can run queries on your logs, from the most recent events collected after you enabled Lake, to historic events brought over from your trails.
Q: Does this import capability impact the original trail in Amazon S3?
The import capability copies the log information from Amazon S3 to CloudTrail Lake and leaves the original copy in Amazon S3 as is.
Q: What CloudTrail events can I query after enabling CloudTrail Lake feature?
You can enable CloudTrail Lake for any of the event categories collected by CloudTrail, depending on your internal troubleshooting needs. Event categories include management events that capture control plane activities such as CreateBucket and TerminateInstances, and data events that capture data plane activities such as GetObject and PutObject. You do not need a separate trail subscription for any of these events. You can choose your event retention duration for up to 7 years, and you can query on that data anytime.
Q: After I enable the CloudTrail Lake feature, how long do I need to wait to begin writing queries?
You can begin querying the activities that occur after enabling the feature almost immediately.
Q: What are some of the common security and operational use cases I can solve using CloudTrail Lake?
Common use cases include investigating security incidents, like unauthorized access or compromised user credentials, and enhancing your security posture by performing audits to regularly baseline user permissions. You can perform ad-hoc audits to make sure the right set of users are making changes to your resources, such as security groups, and track any changes not adhering to your organization’s best practices. Additionally, you can track actions taken on your resources and assess modifications or deletions, and get deeper insights on your AWS services bills including the IAM users subscribing to services.
Q: How do I get started?
All current and new AWS CloudTrail customers can immediately begin using the CloudTrail Lake capability to run queries by enabling the feature via API or the CloudTrail console. Select the Lake tab on the left panel of the CloudTrail console, and click the create event data store button to choose the event retention duration (up to 7 years), and make event selections from all event categories logged by CloudTrail (Management and Data events) to get started.
Additionally, you can use sample queries to start writing queries for common scenarios, such as identifying records of authorization failures for AssumeRole, or create your own queries to begin your search.
Log file aggregation
Q: I have multiple AWS accounts. I would like log files for all the accounts to be delivered to a single S3 bucket. Can I do that?
Yes. You can configure one Amazon S3 bucket as the destination for multiple accounts. For detailed instructions, refer to aggregating log files to a single Amazon S3 bucket section of the AWS CloudTrail User Guide.
Integration with CloudWatch Logs
Q: What is CloudTrail integration with CloudWatch Logs?
CloudTrail integration with CloudWatch Logs delivers management and data events captured by CloudTrail to a CloudWatch Logs log stream in the CloudWatch Logs log group you specify.
Q: What are the benefits of CloudTrail integration with CloudWatch Logs?
This integration enables you to receive Amazon SNS notifications of account activity captured by CloudTrail. For example, you can create CloudWatch alarms to monitor API calls that create, modify, and delete Security Groups and Network access control lists (ACLs).
Q: How do I turn on CloudTrail integration with CloudWatch Logs?
You can turn on CloudTrail integration with CloudWatch Logs from the CloudTrail console by specifying a CloudWatch Logs log group and an IAM role. You can also use the AWS SDKs or the AWS CLI to turn on this integration.
Q: What happens when I turn on CloudTrail integration with CloudWatch Logs?
After you turn on the integration, CloudTrail continuously delivers account activity to a CloudWatch Logs log stream in the CloudWatch Logs log group you specified. CloudTrail also continues to deliver logs to your Amazon S3 bucket as before.
Q: In which AWS regions is CloudTrail integration with CloudWatch Logs supported?
This integration is supported in the regions where CloudWatch Logs is supported. For more information, see Regions and Endpoints in the Amazon Web Services General Reference.
Q: How does CloudTrail deliver events containing account activity to my CloudWatch Logs?
CloudTrail assumes the IAM role you specify to deliver account activity to CloudWatch Logs. You limit the IAM role to only the permissions it requires to deliver events to your CloudWatch Logs log stream. To review IAM role policy, go to the user guide of the CloudTrail documentation.
Q: What charges do I incur once I turn on CloudTrail integration with CloudWatch Logs?
After you turn on CloudTrail integration with CloudWatch Logs, you incur standard CloudWatch Logs and CloudWatch charges. For details, go to CloudWatch pricing page.
CloudTrail Log File Encryption using AWS Key Management Service (KMS)
Q: What is the benefit of CloudTrail log file encryption using Server-side Encryption with KMS?
CloudTrail log file encryption using SSE-KMS allows you to add an additional layer of security to CloudTrail log files delivered to an Amazon S3 bucket by encrypting the log files with a KMS key. By default, CloudTrail will encrypt log files delivered to your Amazon S3 bucket using Amazon S3 server-side encryption.
Q: I have an application that ingests and processes CloudTrail log files. Do I need to make any changes to my application?
With SSE-KMS, Amazon S3 will automatically decrypt the log files so that you do not need to make any changes to your application. As always, you need to make sure that your application has appropriate permissions, i.e. Amazon S3 GetObject and KMS Decrypt permissions.
Q: How do I configure CloudTrail log file encryption?
You can use the AWS Management Console, or AWS CLI or the AWS SDKs to configure log file encryption. For detailed instructions, refer to the documentation.
Q: What charges do I incur once I configure encryption using SSE-KMS?
Once you configure encryption using SSE-KMS, you will incur standard AWS KMS charges. For details, go to AWS KMS pricing page.
CloudTrail Log File Integrity Validation
Q: What is CloudTrail log file integrity validation?
CloudTrail log file integrity validation feature allows you to determine whether a CloudTrail log file was unchanged, deleted, or modified since CloudTrail delivered it to the specified Amazon S3 bucket.
Q: What is the benefit of CloudTrail log file integrity validation?
You can use the log file integrity validation as an aid in your IT security and auditing processes.
Q: How do I enable CloudTrail log file integrity validation?
You can enable the CloudTrail log file integrity validation feature from the AWS Management Console, AWS CLI or AWS SDKs.
Q: What happens once I turn on the log file integrity validation feature?
Once you turn on the log file integrity validation feature, CloudTrail will deliver digest files on an hourly basis. The digest files contain information about the log files that were delivered to your Amazon S3 bucket, hash values for those log files, digital signatures for the previous digest file, and the digital signature for the current digest file in the Amazon S3 metadata section. For more information about digest files, digital signatures and hash values, go to CloudTrail documentation.
Q: Where are the digest files delivered to?
The digest files are delivered to the same Amazon S3 bucket where your log files are delivered. However, they are delivered to a different folder so that you can enforce granular access control policies. For details, refer to the digest file structure section of the CloudTrail documentation.
Q: How can I validate the integrity of a log file or digest file delivered by CloudTrail?
You can use the AWS CLI to validate the integrity of a log file or digest file. You can also build your own tools to do the validation. For more details on using the AWS CLI for validating the integrity of a log file, refer to the CloudTrail documentation.
Q: I aggregate all my log files across all regions and multiple accounts into one single Amazon S3 bucket. Will the digest files be delivered to the same Amazon S3 bucket?
Yes. CloudTrail will deliver the digest files across all regions and multiple accounts into the same Amazon S3 bucket.
AWS CloudTrail Processing Library
Q: What is AWS CloudTrail Processing Library?
AWS CloudTrail Processing Library is a Java library that makes it easy to build an application that reads and processes CloudTrail log files. You can download CloudTrail Processing Library from GitHub.
Q: What functionality does CloudTrail Processing Library provide?
CloudTrail Processing Library provides functionality to handle tasks such as continuously polling a SQS queue, reading and parsing Amazon Simple Queue Service (SQS) messages, downloading log files stored in Amazon S3, parsing and serializing log file events in a fault-tolerant manner. For more information, go to the user guide section of the CloudTrail documentation.
Q: What software do I need to start using the CloudTrail Processing Library?
You need aws-java-sdk version 1.9.3 and Java 1.7 or higher.
Q: How do I get charged for AWS CloudTrail?
AWS CloudTrail allows you to view, search, and download the last 90 days of your account’s management events for free. You can deliver one copy of your ongoing management events to Amazon S3 for free by creating a trail. Once a CloudTrail trail is set up, Amazon S3 charges apply based on your usage.
You can deliver additional copies of events, including data events, using trails. You will be charged for data events or additional copies of management events. Learn more on our pricing page.
Q: If I have only one trail with management events, and apply it to all regions, will I incur charges?
No. The first copy of management events is delivered free of charge in each region.
Q: If I enable data events on an existing trail with free management events, will I get charged?
Yes. You will only be charged for the data events. The first copy of management events is delivered free of charge.
Q: How do the AWS partner solutions help me analyze the events recorded by CloudTrail?
Multiple partners offer integrated solutions to analyze CloudTrail log files. These solutions include features like change tracking, troubleshooting, and security analysis. For more information, see the CloudTrail partners section.
Q: Will turning on CloudTrail impact the performance of my AWS resources, or increase API call latency?
No. Turning on CloudTrail has no impact on performance of your AWS resources or API call latency.