Amazon Cloudtrail

AWS CloudTrail

AWS CloudTrail is a service on Amazon Web Services that is automatically enabled when an AWS account is created, recording every action taken by an AWS Identity and Access Management (IAM) user, role, or AWS service as an event so the account can be audited and monitored for compliance. It enables auditing of API calls, giving customers a way to view, analyze, and respond to activity across the AWS infrastructure. Where Amazon Cloudwatch monitors and reports on the health and performance of AWS resources, CloudTrail resembles a log of every action performed inside the AWS environment.

AI Practitioner focus

• CloudTrail records control-plane/API activity for auditing: who/what made a call, when, from where, and against which resource. Use trails/event data stores for retention and analysis beyond Event History.
• For AI governance, record model, data, and agent-service API activity, but design application-level logs for prompts, retrieval, tool calls, approvals, and outputs with privacy in mind.

Key points

• Enabled automatically the moment an AWS account is created; used to enable compliance and auditing of the account.
• Enables auditing of API calls — every API call is recorded as a new event within a log file tied to a particular object; new log files are typically delivered to the configured S3 bucket about every 5 minutes.
• Records actions as an event triggered by an IAM user, an IAM role, or an AWS service.
• CloudTrail event records can be downloaded/exported as JSON or CSV files for offline analysis.
• Example IAM log file event: IAM user Rohit used the AWS Management Console to call the AddUserToGroup action to add Nayan to the administrator group, captured with fields such as eventVersion, userIdentity, eventTime, eventSource, eventName, awsRegion, sourceIPAddress, userAgent, requestParameters, and responseElements.
• Three event categories, only one logged by default:
  • Management events (a.k.a. control-plane operations) — configuring security, registering devices, setting up routing rules, and other account/resource setup actions (e.g. IAM AttachRolePolicy, EC2 CreateSubnet). Trails and Event history log these by default at no extra charge.
  • Data events (control-plane vs. data-plane distinction) — high-volume resource operations performed on or within a resource, such as S3 object-level GetObject/PutObject calls or Lambda function invocations. Not logged by default — must be explicitly enabled per trail/event data store, and incur additional charges; this is a frequently tested exam point.
  • Insights events — CloudTrail Insights automatically detects unusual API activity, such as spikes in call volume or error rates, and logs an Insights event when it does; must be explicitly enabled on top of management event logging.
• CloudWatch vs. CloudTrail: CloudWatch monitors and manages the activity of AWS services and resources, reporting on their health and performance, whereas CloudTrail is the record — a log of all actions performed inside the AWS environment.
• Supports auditing, security monitoring, and operational troubleshooting by tracking user activity and API usage and calls.
• Distinct from Amazon Config, which tracks the resulting configuration state and compliance of a resource rather than who called which API.
• Without a configured trail, Event history retains the last 90 days of management events by default; creating a trail delivers events to an S3 bucket (and optionally a CloudWatch Logs log group) for longer retention and near-real-time alerting.
• A trail can be configured to apply to all AWS Regions (a multi-region trail), and supports log file integrity validation to detect whether a delivered log file has been tampered with.

Sources

• What is AWS CloudTrail?
• Logging management events
• Logging data events