Icon source: AWSAmazon Web Services (AWS) CloudTrail is a service designed to enable governance, compliance, operational auditing, and risk auditing of your AWS account. With CloudTrail, users can log, continuously monitor, and retain account activity related to actions across their AWS infrastructure. This service provides an invaluable layer of insight that helps organizations ensure compliance with internal policies and regulatory standards by tracking user activity and API usage across their AWS environments.
CloudTrail focuses on who did what, when, and from where in AWS. It records API calls and related events made by or on behalf of an AWS account. These calls can originate from various sources including the AWS Management Console, AWS SDKs, command line tools, and higher-level AWS services. The detailed logging covers calls made to almost all AWS services, capturing information including the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service.
Network activity events record AWS API actions made through VPC endpoints, including requests allowed or denied by endpoint policies. These events are delivered only to the VPC endpoint owner and must be explicitly enabled on a trail or event data store.
The data recorded by CloudTrail enables AWS customers to perform security analysis, resource change tracking, and troubleshooting. Importantly, it also helps in detecting unusual activity in their accounts which can indicate potential security incidents or vulnerabilities. Additionally, for customers subject to regulatory requirements, CloudTrail's logs can play a crucial role in demonstrating compliance with external policies. AWS CloudTrail logs are stored in an S3 bucket specified by the user, and the service supports the encryption of the log files using AWS Key Management Service (AWS KMS) for added security.
CloudTrail Lake can ingest activity events from AWS, other cloud providers, in-house applications, and SaaS applications, and immutably store audit-worthy events. CloudTrail Lake will no longer be open to new customers starting May 31, 2026. For similar capabilities, explore Amazon CloudWatch.
CloudTrail Insights analyzes management and data events to help identify and respond to unusual activity associated with API call rates and API error rates.
CloudTrail also integrates with Amazon CloudWatch Logs and Amazon EventBridge, providing a way to take real-time action on the log data it captures. For example, users can set up alerts for specific events like the creation of new IAM users or roles, or the deletion of EC2 instances, helping them respond quickly to changes in their AWS environment. One of the key benefits of AWS CloudTrail is its ability to centralize logging across multiple accounts and AWS regions. This feature is particularly useful for large organizations with multiple teams operating in different environments. By aggregating logs in a single account, organizations can simplify their monitoring and auditing processes, making it easier to analyze activity patterns and identify potential issues.
CloudTrail management and data events can also be delivered directly to CloudWatch Logs without creating a trail.
Overall, AWS CloudTrail offers a powerful and convenient way to increase visibility into the actions being performed in an AWS environment. CloudTrail records account activity and service events from most AWS services. This level of oversight and detail makes CloudTrail a fundamental component of any robust AWS security strategy.
AWS Lambda
Amazon S3