Study guide
Technical reference and lesson notes
Purpose of This Lesson
AWS CloudTrail records API activity in an AWS account. This lesson focuses on creating a trail that delivers audit logs to Amazon S3 for retention beyond the limited CloudTrail Event history window.
CloudTrail is useful for investigating changes, identifying the identity and source of an action, supporting compliance, and feeding events into other services such as Amazon EventBridge or Amazon CloudWatch Logs.
Key Concepts
CloudTrail Event History Versus a Trail
The CloudTrail console provides Event history without requiring a trail. Event history is intended for recent investigation and retains the previous 90 days of management events.
A trail is required when you need to:
- Retain CloudTrail logs for longer than 90 days.
- Store logs in Amazon S3 for archival, analysis, or compliance.
- Deliver events to CloudWatch Logs for monitoring and alerting.
- Configure the categories of events to record.
- Centralize logging across an AWS organization, where supported by the selected trail configuration.
A trail continuously delivers selected CloudTrail events to a configured destination, most commonly an S3 bucket.
CloudTrail Event Categories
#### Management Events
Management events record control-plane operations that configure or change AWS resources. Examples include:
- Launching or terminating an Amazon EC2 instance.
- Creating an Amazon S3 bucket.
- Changing an IAM policy or role.
- Modifying security or networking configuration.
Management events can be configured for read-only activity, write activity, or both. Recording both provides broader audit coverage, while limiting read events can reduce volume in environments where read activity is not needed.
#### Data Events
Data events record operations performed against the contents of a resource rather than changes to the resource configuration. For Amazon S3, examples include object-level operations such as reading or deleting objects.
Data events can generate substantially more log volume than management events. Enable them selectively for sensitive buckets, Lambda functions, or other supported resources instead of automatically enabling them for every resource.
#### Insights Events
CloudTrail Insights helps identify unusual API activity, such as unexpected changes in API call volume or error rates. It is intended for detecting anomalous operational behavior rather than recording every normal API action.
S3 as the Trail Destination
When creating a trail, CloudTrail can create an S3 bucket automatically or use an existing bucket. The resulting log structure includes AWS log prefixes, account information, and CloudTrail log data. Delivery is not necessarily instantaneous; newly generated files may take several minutes to appear.
For production audit logging, consider the following S3 controls:
- Restrict bucket access using a narrowly scoped bucket policy.
- Enable encryption, preferably with an AWS Key Management Service (AWS KMS) key when organizational key control is required.
- Enable S3 versioning and appropriate retention protections where compliance requires them.
- Use lifecycle policies to transition or expire logs according to retention requirements.
- Prevent unauthorized deletion through IAM controls, bucket policies, and, where appropriate, S3 Object Lock.
Log File Validation
CloudTrail log file validation helps detect whether log files were modified or deleted after delivery. Leave validation enabled when the logs are used as an audit record or may need to support forensic or compliance investigations.
Validation helps establish integrity, but it does not replace access control, encryption, retention policies, or monitoring of the log destination.
CloudWatch Logs Integration
A trail can also deliver events to CloudWatch Logs. This enables CloudWatch-based metric filters, alarms, dashboards, and integrations with operational workflows.
A common design is:
- Amazon S3: durable, long-term audit retention.
- CloudWatch Logs: near-real-time operational monitoring and alerting.
- Amazon EventBridge: event-driven automation based on selected AWS API activity.
These destinations solve different problems and may be used together.
Organization-Wide Trails
In an AWS Organizations environment, a trail can be configured to apply across organization accounts when the required organizational permissions and setup are in place. Centralized collection reduces the risk that individual member accounts omit or alter their own audit configuration.
A centralized logging account is commonly used as the destination for organization-wide CloudTrail data. The destination bucket policy must permit the appropriate CloudTrail delivery activity while preventing unrelated access.
Exam-Relevant Takeaways
- CloudTrail Event history is not a substitute for long-term audit storage; it covers only the recent 90-day window for management events.
- Create a trail and deliver events to Amazon S3 when retention beyond the Event history period is required.
- Management events describe control-plane activity such as creating, modifying, or terminating resources.
- Data events describe object-level or resource-content operations and can create high log volume and cost.
- Insights events help detect unusual API activity; they are not a replacement for standard management or data event logging.
- Enable both read and write management events when the requirement is comprehensive API auditing.
- Use CloudWatch Logs when the requirement includes filtering, alerting, or operational visibility.
- Keep log file validation enabled when audit-log integrity matters.
- A trail can use an automatically created S3 bucket, but production environments usually require deliberate bucket security, retention, and access design.
- CloudTrail log delivery can be delayed by several minutes, so do not assume a newly executed action will appear in S3 immediately.
Architecture Decision Guide
| Requirement | Recommended CloudTrail design | Important consideration |
|---|---|---|
| Investigate recent API activity | CloudTrail Event history | Limited to the recent 90-day management-event window |
| Retain audit logs for years | Trail delivering to Amazon S3 | Apply encryption, access controls, lifecycle, and retention protection |
| Monitor API activity with alarms | Trail plus CloudWatch Logs | Configure filters, alarms, and appropriate permissions |
| Audit object-level S3 access | Enable selected S3 data events | High volume is possible; scope to important buckets or prefixes |
| Detect unusual API behavior | Enable CloudTrail Insights events | Complements, but does not replace, regular event logging |
| Collect activity from multiple accounts | Organization-wide trail and centralized S3 destination | Configure Organizations permissions and a secure destination bucket |
| Verify audit-log integrity | Enable log file validation | Integrity validation does not prevent unauthorized access or deletion |
| Trigger automation from API activity | CloudTrail events with Amazon EventBridge | Account for delivery latency and event-pattern design |
Common Exam Traps
- Confusing Event history with a trail: Event history provides short-term visibility; a trail provides configurable delivery and retention.
- Assuming all S3 activity is logged by default: Management events do not automatically provide object-level data-event coverage.
- Enabling data events everywhere: This can create unnecessary log volume and cost. Scope data events to resources that require object-level auditing.
- Treating CloudTrail as a real-time system: Delivery to S3 or downstream services may take time.
- Using Insights as the complete audit record: Insights detects unusual patterns but does not replace normal event capture.
- Ignoring the log destination: A secure CloudTrail design must protect the S3 bucket and its contents from unauthorized access or deletion.
- Disabling log validation without a reason: Validation is valuable when logs are evidence for security investigations or compliance.
- Assuming a trail automatically covers every account: Organization-wide collection requires the appropriate AWS Organizations configuration and permissions.
Real-World Engineer Notes
- Separate the account that owns centralized security logs from workload accounts whenever possible.
- Use a dedicated S3 logging bucket rather than mixing audit data with application objects.
- Restrict write access to the CloudTrail bucket and limit read access to security, audit, and incident-response roles.
- Consider S3 versioning, Object Lock, and a carefully reviewed lifecycle policy for high-value audit logs.
- Send selected CloudTrail events to CloudWatch Logs or EventBridge when the operational requirement is prompt detection rather than long-term retention alone.
- Test the complete path: generate an API action, verify delivery, validate access permissions, and confirm that retention controls behave as intended.
- Expect a short delay between an API operation and its appearance in the S3 log hierarchy.
Quick Reference Summary
- Event history: Console-based view of recent CloudTrail management events, retained for 90 days.
- Trail: Configurable, ongoing delivery of CloudTrail events to destinations such as S3.
- Management events: Control-plane operations.
- Data events: Resource-content or object-level operations.
- Insights events: Detection of unusual API activity.
- S3: Durable destination for long-term CloudTrail retention.
- CloudWatch Logs: Filtering, dashboards, and alarms.
- Log file validation: Helps detect tampering with delivered log files.
- Organization trail: Centralized event collection across AWS accounts when correctly configured.
Flashcards
- Q: How long does CloudTrail Event history retain management events?
A: The recent 90-day period. A trail is required for longer retention.
- Q: What is the primary purpose of a CloudTrail trail?
A: To continuously deliver selected CloudTrail events to destinations such as Amazon S3.
- Q: What type of event records an EC2 instance termination?
A: A management event.
- Q: What type of event records an S3 object read?
A: A data event.
- Q: Why should S3 data events be enabled selectively?
A: Object-level activity can generate a large volume of logs and associated cost.
- Q: What do CloudTrail Insights events identify?
A: Unusual API activity or patterns, such as unexpected changes in API call volume or errors.
- Q: Which service is commonly used for long-term CloudTrail log storage?
A: Amazon S3.
- Q: Which service can process CloudTrail logs for metric filters and alarms?
A: Amazon CloudWatch Logs.
- Q: What does CloudTrail log file validation provide?
A: A way to detect whether delivered log files were modified or deleted.
- Q: What is a major benefit of an organization-wide trail?
A: It centralizes audit collection across AWS accounts and reduces account-by-account configuration gaps.
- Q: Should CloudTrail delivery to S3 be expected to be instantaneous?
A: No. Delivery can take several minutes.
- Q: Does enabling management events automatically log S3 object operations?
A: No. Object-level activity requires appropriate S3 data-event configuration.
Practice Questions
Question 1
A security team must investigate API activity from the previous two years. The team does not need object-level S3 access logging, but it must retain resource changes and IAM activity in a durable location. What is the best design?
A. Use CloudTrail Event history only
B. Create a trail that records management events and delivers them to Amazon S3
C. Enable CloudTrail Insights only
D. Enable S3 data events for every bucket
Correct answer: B
Explanation: Event history is limited to the recent 90-day management-event window. A trail delivering management events to S3 provides long-term retention. Insights and data events do not replace standard management-event logging.
Question 2
An organization wants to audit reads and deletes of objects in a sensitive S3 bucket. It is concerned about logging volume and cost for its other buckets. Which configuration is most appropriate?
A. Enable management events only for the entire organization
B. Enable S3 data events for the sensitive bucket only
C. Enable Insights events for all accounts
D. Rely on S3 server access logs for all AWS API activity
Correct answer: B
Explanation: S3 object operations are data events. Data-event selectors should be scoped to the sensitive bucket or relevant resources to avoid unnecessary volume. Management events and Insights do not provide complete object-level auditing.
Question 3
A security operations team needs to generate a CloudWatch alarm when an IAM policy is changed. It also wants a durable copy of the audit record for compliance. Which design meets both requirements?
A. Store CloudTrail Event history in the console
B. Create a trail that sends events to both Amazon S3 and CloudWatch Logs
C. Enable CloudTrail Insights and disable management events
D. Enable S3 data events without creating a trail
Correct answer: B
Explanation: S3 provides durable retention, while CloudWatch Logs supports filtering and alarms. IAM policy changes are management events, so those events must be enabled.
Question 4
An auditor requires evidence that CloudTrail log files stored in S3 were not altered after delivery. Which trail option directly supports this requirement?
A. CloudTrail Insights
B. Read-only management events
C. Log file validation
D. CloudWatch dashboards
Correct answer: C
Explanation: Log file validation helps detect modification or deletion of CloudTrail log files after delivery. It should be combined with strong S3 access control and retention protections.
Question 5
A newly created trail is active, but the administrator does not immediately see a log file in its S3 destination after performing an API operation. What is the most likely explanation?
A. CloudTrail Event history must be disabled first
B. CloudTrail log delivery can take several minutes
C. Data events must always be enabled
D. Trails cannot deliver to S3 buckets created by CloudTrail
Correct answer: B
Explanation: CloudTrail delivery is not instantaneous. A short delay before log files appear in S3 is expected.