An introduction to CloudTrail.

• CloudTrail provides governance, compliance, and audit for an AWS account.
• Enabled by default.
• You can view history of API calls / history of events in your AWS account.
• Events are stored for 90 days (for long-term storage, use S3 and Athena).
• Logs from CloudTrail can be stored in CloudWatch Logs or S3.
• Trails can be applied to All Regions or a single Region.

Management Events:

• Actions involving creation, modification, or deletion of resources. Also includes user sign-ins.
• Separates Read Events and Write Events.
• Logged by default.

Data Events:

• Object / resource-level actions (ex. GetObject / PutObject in S3).
• Not logged by default.
• If you require visibility in who accessed a specific S3 object, you’d need to enable data events.

CloudTrail Insights:

• Detects unusual API activity (ex. sudden burst of IAM CreateUser API calls, spike in failed API calls, etc).
• Analyses account baseline and automatically flags anomalous events.
• Optional. Not enabled by default.

CloudTrail Lake:

• A managed data lake allowing you aggregate, store and query events.
• Includes:
  • CloudTrail Events
  • CloudTrail Insights Events
  • Config Configuration Items
  • AWS Audit Manager
  • 3rd Party Events
• Immutable storage with max. 10 year retention period.
• Store events from AWS Organisations.
• You can also build interactive dashboards with the data from the lake.

More reading:

• https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html