AWS CloudTrail Logging, Auditing, and Multi-Account Governance – SAP-C02 Study Guide

Purpose of This Lesson

AWS CloudTrail provides an audit record of activity in an AWS account. It records API activity performed by IAM users, IAM roles, AWS services, and applications, including who made a request, what action was performed, which resources were involved, when it occurred, and contextual information such as the source IP address.

CloudTrail is foundational for security investigations, compliance auditing, operational troubleshooting, and tracking configuration changes across AWS environments.

Key Concepts

CloudTrail event history

AWS accounts automatically receive CloudTrail event history for recent management events. This history is searchable from the CloudTrail console and API for up to 90 days.

Typical searchable attributes include:

• Event name, such as RunInstances or DeleteBucket
• Event source, such as ec2.amazonaws.com
• Username or assumed role identity
• Resource name or resource type
• Event time
• Source IP address

Event details are represented in JSON and may include request parameters, user identity, affected resources, AWS Region, error information, and other context.

Event history is useful for short-term investigation, but it is not a long-term archive. Use a trail or CloudTrail Lake event data store when retention beyond 90 days is required.

Trails and long-term delivery

A trail delivers CloudTrail events to durable destinations such as:

• Amazon S3 for long-term retention and centralized archival
• Amazon CloudWatch Logs for log analysis, metric filters, and alarms

A trail can be configured for one Region or for all AWS Regions. A multi-Region trail is generally preferred for security auditing because it captures activity across the account rather than leaving unmonitored Regions.

When using Amazon S3, apply appropriate bucket policies, encryption, retention controls, and access restrictions. For high-assurance audit storage, consider versioning, S3 Object Lock, and a dedicated logging account.

Management events

Management events represent control-plane activity: operations that create, modify, describe, or delete AWS resources and configurations.

Examples include:

• Creating or deleting a VPC
• Modifying a security group
• Starting or stopping an EC2 instance
• Creating an IAM policy
• Changing an S3 bucket configuration

Management events are enabled by default in CloudTrail event history. Trails can be configured to record read events, write events, or both, depending on the required audit scope.

Data events

Data events represent activity inside a resource and are sometimes called data-plane operations. Examples include:

• GetObject, PutObject, and DeleteObject in Amazon S3
• Lambda function invocations
• DynamoDB item-level operations

Data events are not enabled by default for trails and can generate substantial volume and cost. Configure them selectively for sensitive buckets, functions, or tables rather than enabling every possible data event indiscriminately.

CloudTrail Insights events

CloudTrail Insights identifies unusual API activity by comparing current behavior with an established baseline. It can detect patterns such as:

• A sudden increase in API calls
• Abnormally high error rates
• Unexpected changes in API usage
• Automation loops or possible misconfiguration

Insights events are useful for detecting anomalies, but they are not a replacement for real-time application monitoring or a full security detection platform.

Network activity events

Network activity events capture supported API activity made through VPC endpoints. They can help determine:

• Which principal or service made a request
• Which target AWS service was contacted
• Whether the request was allowed or denied
• Which VPC endpoint was involved

These events are particularly useful when troubleshooting interface or gateway endpoint policies and investigating unexpected private connectivity usage. Availability depends on the AWS service and event source being supported.

Destinations and integrations

#### Amazon S3

S3 is the usual destination for durable, centralized CloudTrail archives. Logs can be queried later with services such as Amazon Athena, provided the data is cataloged appropriately.

#### Amazon CloudWatch Logs

CloudTrail can deliver events to a CloudWatch Logs log group. CloudWatch Logs supports operational analysis, metric filters, alarms, and integration with other monitoring workflows.

For example, a metric filter could detect unauthorized API calls and publish a CloudWatch alarm to an Amazon SNS topic.

#### Amazon EventBridge

EventBridge can match CloudTrail API events and route them to targets such as:

• AWS Lambda
• Amazon SNS
• AWS Step Functions
• SQS queues
• Systems Manager automation

For example, an EventBridge rule could detect a change to a security group and invoke a remediation workflow.

A key distinction is that EventBridge receives supported CloudTrail management events through the AWS service integration; a trail is not required merely to match those events with EventBridge. A trail is still required when you need durable delivery to S3 or CloudWatch Logs. Data-event use cases require the relevant event source and data events to be configured as applicable.

CloudTrail Lake

CloudTrail Lake provides managed storage and SQL-based querying for audit data. It uses event data stores as containers for collected events. Each event data store can have its own:

• Retention period
• Event selectors and data sources
• Access controls
• Purpose, such as security investigations or compliance reporting

CloudTrail Lake can ingest CloudTrail activity and supported external event sources. It allows queries to run directly against the stored data without first exporting files to S3 and configuring Athena.

CloudTrail Lake dashboards provide query-based visual summaries, such as API activity, errors, and unusual behavior. CloudTrail channels can be used to bring supported external activity into CloudTrail Lake using the CloudTrail event format.

Use CloudTrail Lake when the requirement emphasizes managed, queryable audit storage and investigation workflows. Use S3 when the requirement emphasizes low-cost archival, broad data-lake integration, or independent retention controls.

Multi-account and organization-wide logging

A secure AWS environment should centralize audit logs so that workloads and account administrators cannot easily delete or disable the evidence of their own activity.

Common designs include:

1. Cross-account destination: Trails in workload accounts deliver logs to an S3 bucket in a dedicated logging account. The destination bucket policy grants CloudTrail permission to write logs from the approved accounts.
2. AWS Organizations organization trail: An organization trail is created from the management account and applies to member accounts. Central governance can help prevent member accounts from disabling or altering required logging.
3. Dedicated log archive account: A separate account stores CloudTrail data with tightly restricted access, encryption, versioning, and retention controls.

For organization-wide security, configure a multi-Region organization trail and centralize delivery into a protected logging or log archive account. Consider separate trails or event data stores where different retention, access, or event-selection requirements apply.

Exam-Relevant Takeaways

• CloudTrail records AWS API activity for auditing and investigation.
• Event history provides recent management events for up to 90 days; it is not a permanent archive.
• Create a trail for persistent delivery to S3 or CloudWatch Logs.
• A multi-Region trail is generally the correct choice for complete account auditing.
• Management events concern resource configuration and control-plane operations.
• Data events concern activity inside resources, such as S3 object access, and are not enabled by default for trails.
• CloudTrail Insights detects unusual API activity against a baseline.
• EventBridge can respond to supported CloudTrail events; a trail is needed for persistent S3 or CloudWatch Logs delivery, not simply for supported EventBridge management-event matching.
• S3 is appropriate for durable, centralized archives and Athena-based analysis.
• CloudTrail Lake provides managed event storage and SQL queries through event data stores.
• Centralize logs in a protected account, preferably using an organization trail in multi-account environments.
• Use bucket policies and least-privilege access to control cross-account log delivery and audit access.

Architecture Decision Guide

Requirement	Recommended approach	Important consideration
Investigate recent resource changes	CloudTrail event history	Limited to recent management events and up to 90 days
Retain audit records for years	Multi-Region trail to S3	Configure retention, encryption, access control, and immutability as needed
Search CloudTrail files with SQL	S3 plus Athena	Requires appropriate table/schema and query design
Alert when a sensitive API call occurs	EventBridge rule targeting SNS, Lambda, or another target	Use an event pattern for the relevant API activity
Analyze delivered logs with operational alarms	Trail to CloudWatch Logs	Use metric filters and CloudWatch alarms where appropriate
Record S3 object access	Enable S3 data events for selected resources	High event volume and cost are possible
Detect abnormal API volume or error patterns	CloudTrail Insights	Detection is baseline-based and not an all-purpose threat detector
Query audit data without managing S3 files	CloudTrail Lake event data store	Evaluate retention and ingestion costs
Audit all accounts and Regions	Organization trail with centralized destination	Protect the management and log archive paths from tampering

Common Exam Traps

• Confusing event history with a trail: Event history is automatically available for recent management events, but long-term retention requires a trail or CloudTrail Lake event data store.
• Assuming all API activity is logged by default: S3 object operations and similar data events require explicit configuration.
• Using a single-Region trail for global auditing: A single-Region trail can leave activity in other Regions unrecorded. Select all Regions when the requirement is account-wide auditing.
• Sending logs to the workload account: If administrators of the workload account can delete the logs, the audit design is weaker. Prefer a dedicated logging or log archive account.
• Enabling every data event without considering cost: Data events can be high volume. Scope selectors to sensitive resources and required operations.
• Treating CloudTrail as application logging: CloudTrail records AWS activity and API calls. It does not replace application logs, VPC Flow Logs, or service-specific access logs.
• Assuming CloudTrail blocks unauthorized actions: CloudTrail records activity; IAM, SCPs, endpoint policies, and resource policies enforce authorization.
• Assuming a trail is always required for EventBridge: Supported CloudTrail management events can be delivered to EventBridge without a trail. A trail is required for persistent S3 or CloudWatch Logs delivery.
• Ignoring log integrity: Encryption alone does not prevent deletion or modification by an overly privileged principal. Use restrictive policies, versioning, and Object Lock where immutable evidence is required.

Real-World Engineer Notes

• Keep audit collection independent from the accounts and teams that operate production workloads.
• Limit access to the log archive. Most engineers should not have delete or policy-changing permissions on the destination bucket.
• Use separate event-selection and retention strategies for security investigations, compliance archives, and operational troubleshooting.
• Alert on high-value actions such as disabling CloudTrail, changing IAM policies, modifying security groups, altering key policies, or creating public access paths.
• Record both read and write management events when the audit requirement is broad; restrict selections only when volume, cost, or privacy requirements justify it.
• Use S3 lifecycle policies to transition older logs to lower-cost storage when retention requirements permit, while preserving any required immutability.
• CloudTrail event records can be valuable inputs to automated remediation, but remediation should be carefully scoped to avoid loops or disrupting legitimate changes.
• Combine CloudTrail with AWS Config for resource configuration history, VPC Flow Logs for network traffic metadata, and application logs for end-to-end troubleshooting.

Quick Reference Summary

• CloudTrail: AWS API auditing and event history.
• Event history: Recent management events, retained for up to 90 days.
• Trail: Persistent delivery to S3 and/or CloudWatch Logs.
• Management events: Control-plane resource and configuration actions.
• Data events: Data-plane activity inside resources; configure explicitly.
• Insights events: Unusual API activity compared with a baseline.
• Network activity events: Supported activity through VPC endpoints.
• EventBridge: Event-driven response to supported CloudTrail events.
• CloudTrail Lake: Managed event storage and SQL queries using event data stores.
• Best multi-account pattern: Multi-Region organization trail delivering to a protected central logging account.

Flashcards

1. Q: What does AWS CloudTrail record?

A: API activity performed by users, roles, services, and applications, including identity, action, resources, time, and request context.

1. Q: How long is CloudTrail event history available by default?

A: Up to 90 days for recent management events.

1. Q: What provides persistent CloudTrail delivery to Amazon S3?

A: A CloudTrail trail.

1. Q: What are management events?

A: Control-plane operations that create, modify, describe, or delete AWS resources and configurations.

1. Q: What are data events?

A: Data-plane operations inside resources, such as S3 object access or Lambda invocations.

1. Q: Why are data events not enabled broadly by default?

A: They can generate very high event volume and additional cost.

1. Q: Which CloudTrail feature detects unusual API activity?

A: CloudTrail Insights.

1. Q: Which service can trigger Lambda or SNS from a matching CloudTrail event?

A: Amazon EventBridge.

1. Q: Is a trail required for supported CloudTrail management events to reach EventBridge?

A: No. A trail is required for persistent delivery to destinations such as S3 or CloudWatch Logs.

1. Q: What is CloudTrail Lake used for?

A: Managed storage and SQL querying of CloudTrail and supported external audit events.

1. Q: What is an event data store?

A: A CloudTrail Lake storage container with its own retention, access, and event-source configuration.

1. Q: Why centralize CloudTrail logs in another account?

A: To reduce the ability of workload-account administrators to disable, alter, or delete audit evidence.

Practice Questions

Question 1

A company must retain API activity from every AWS account and Region for seven years. Account administrators must not be able to delete the audit records. Which design best meets the requirement?

A. Use each account’s CloudTrail event history and export events every 90 days.
B. Create a multi-Region organization trail that delivers to an S3 bucket in a dedicated log archive account, with restrictive policies and retention controls.
C. Send CloudTrail events to a CloudWatch Logs group in each workload account.
D. Enable CloudTrail Insights in each workload account.

Correct answer: B

Explanation: Event history is limited to 90 days, and Insights is for anomaly detection rather than archival. A centralized organization trail with a protected cross-account S3 destination provides broad coverage and durable retention. Additional controls such as versioning and Object Lock may be appropriate for immutability.

Question 2

A security team needs an alert whenever an IAM policy is changed. The alert should be near real time and should invoke an AWS Lambda function. Which solution is most appropriate?

A. Query CloudTrail files in S3 with Athena every hour.
B. Create an EventBridge rule matching the relevant CloudTrail API events and target Lambda.
C. Enable S3 data events for the IAM policy bucket.
D. Use CloudTrail Insights to detect the policy change.

Correct answer: B

Explanation: IAM policy changes are management events. EventBridge can match supported CloudTrail management events and invoke Lambda without requiring a trail solely for that EventBridge integration.

Question 3

An organization must determine which principals accessed objects in a sensitive S3 bucket. The access records must be retained in S3 for compliance analysis. What should be configured?

A. Enable S3 data events for the bucket in a CloudTrail trail that delivers to S3.
B. Enable only CloudTrail management events.
C. Enable CloudTrail Insights for the account.
D. Use VPC Flow Logs for the S3 bucket.

Correct answer: A

Explanation: Object-level operations such as GetObject and PutObject are data events, not management events. Configure S3 data-event selectors for the required bucket and deliver them through a trail to S3.

Question 4

A network team is troubleshooting denied requests sent to an AWS service through an interface VPC endpoint. They need to identify the caller, target service, endpoint, and allow/deny result. Which CloudTrail capability is most relevant?

A. Management events
B. Data events for an S3 bucket
C. Network activity events
D. CloudTrail Insights

Correct answer: C

Explanation: Network activity events capture supported requests made through VPC endpoints and include information useful for diagnosing endpoint-policy and private-connectivity issues.

Question 5

A company wants to run SQL queries against long-term CloudTrail data and supported external audit events without managing log files in S3 or configuring Athena. Which service should it use?

A. CloudWatch Logs Insights
B. CloudTrail Lake
C. Amazon Macie
D. AWS Config

Correct answer: B

Explanation: CloudTrail Lake provides managed event data stores and SQL querying for CloudTrail activity and supported external event sources. CloudWatch Logs Insights queries CloudWatch log groups, while Athena requires data to be stored and prepared in S3.