AWS CloudTrail

An audit log service that records operation history on AWS.

A service that records the history of API operations within an AWS account. Lets you track who changed what and when.

• Tracking changes to IAM settings
• Reviewing suspicious API operations
• Audit response

• Records API operation history of users and services
• Used for security auditing
• Has a different purpose from CloudWatch

• Can aggregate trails across the entire organization
• Logs can be stored in S3
• Consider log tamper detection and KMS encryption

AWS CloudTrail is an audit log service that records all API calls within an AWS account. It captures who (IAM principal), what service was called, when (timestamp), where from (source IP), and what operation (API name, request parameters, response) was executed. This data is used in post-incident security investigations, compliance audits, and operational troubleshooting. Enabling it across all regions is a security baseline, and combining it with AWS Organizations allows centralized management of events across multiple accounts. CloudTrail events are roughly divided into three types. Management events (control plane operations such as EC2 instance launches and IAM policy changes) are by default viewable in the "Event history" for the last 90 days. Data events such as S3 object GET/PUT operations are disabled by default; enabling them increases cost. By configuring a Trail, events can be stored long-term in an S3 bucket, exported to CloudWatch Logs, or analyzed via Amazon Athena. CLF-C02 frequently asks about CloudTrail as a service for "recording AWS API operations" or "investigating who modified resources". Because CloudWatch (metrics, alarms) and AWS Config (recording resource configuration changes and rule compliance) are easy to confuse, clearly distinguishing the roles of these three services is important.

• AWS CloudTrail (AWS Official)
• AWS CloudTrail User Guide (AWS Official Documentation)
• How CloudTrail Works (AWS Official Documentation)

Last updated: 2026-06-01