TopolearnCloudTrail is the audit log for security investigations, compliance and answering 'who changed this?'.
CloudTrail records API calls made in your account: by the console, CLI, SDKs and AWS services acting for you. Each event has the identity (userIdentity, including the assumed role and session name), event name, time, source IP, user agent, request parameters and the error code if it failed.
Event categories:
- Management events: control-plane operations such as
RunInstances,PutBucketPolicy,CreateUser,ConsoleLogin. Recorded by default. - Data events: high-volume operations on resources, such as S3
GetObject, LambdaInvokeand DynamoDB item reads. Off by default and charged; enable them selectively with advanced event selectors. - Network activity events for API calls through VPC endpoints, and Insights events for unusual call rates.
Event history shows the last 90 days of management events in each Region for free, which is enough for quick questions. For durable auditing create a trail: multi-Region, ideally an organization trail from the management or delegated admin account, delivering to an S3 bucket in a dedicated log-archive account with log file validation, KMS encryption and Object Lock. Send it to CloudWatch Logs as well to alarm on events such as root logins or security-group changes. CloudTrail Lake stores events for SQL queries.
CloudTrail answers who called what. AWS Config complements it with what each resource looked like over time and compliance rules, and GuardDuty analyses CloudTrail, VPC flow and DNS logs to detect threats. Enable all three in every account.
Example
# Who deleted a bucket recently? (free 90-day event history)
aws cloudtrail lookup-events \
--lookup-attributes AttributeKey=EventName,AttributeValue=DeleteBucket \
--max-results 5 --query 'Events[].[EventTime,Username,EventName]' --output text
# 2026-10-16T14:02:11+00:00 alice DeleteBucket
aws cloudtrail create-trail --name org-trail --s3-bucket-name acme-cloudtrail-logs \
--is-multi-region-trail --is-organization-trail \
--enable-log-file-validation --kms-key-id alias/cloudtrail
aws cloudtrail start-logging --name org-trail
# Advanced selectors replace basic ones: keep management events explicitly!
aws cloudtrail put-event-selectors --trail-name org-trail --advanced-event-selectors '[
{"Name": "Management", "FieldSelectors": [
{"Field": "eventCategory", "Equals": ["Management"]}]},
{"Name": "Payroll object access", "FieldSelectors": [
{"Field": "eventCategory", "Equals": ["Data"]},
{"Field": "resources.type", "Equals": ["AWS::S3::Object"]},
{"Field": "resources.ARN", "StartsWith": ["arn:aws:s3:::acme-payroll/"]}]}]'Remember
- CloudTrail logs API calls with identity, time, source and parameters
- Management events are on by default; data events are opt-in and billed
- Use a multi-Region organization trail into a locked-down log-archive account
- Pair with AWS Config and GuardDuty
Watch out for
- Writing trail logs to a bucket in the same account that an attacker with admin rights could delete.