AWS CloudTrail
Log of who called which API
Records every API call in the account: who, when, from where, what they did; used for auditing and security investigations.
- Cost$ Low
- Difficulty●●●●●
- Costs money when idle?A little
- Managed by AWS
- In examsCLF · SAA · SOA
Think of it asLike a security camera recording everyone who comes and goes and what they do.
Where does CloudTrail fit?
CloudTrailCloudTrail calls
A real example, step by step
- On Monday morning, the database's security group has been opened to the whole internet.
- You open CloudTrail event history and filter on the AuthorizeSecurityGroupIngress event.
- CloudTrail shows which user made the call, at 11:14 p.m. on Sunday, from which IP address and with which tool.
- You had already created an organization trail writing to an S3 bucket in a separate audit account, with log file validation.
- So the logs can't be altered or deleted, and they're still there for investigations months later.
When to use it
✓ Use it when
Auditing, compliance, security incident investigation.
✗ Avoid it when
Measuring application performance → CloudWatch.
Common uses
- Auditing: who deleted a resource, and when
- Security incident investigation
- Regulatory compliance (keep logs 1–7 years)
CloudTrail, CloudWatch or CloudWatch Logs?
| CloudTrail |  CloudWatch | CloudWatch Logs | |
|---|---|---|---|
| Answers | Who did what, when and from where? | How is the system running? | What did the app write out? |
| Data | AWS API calls | Metrics, alarms | Application logs |
| On by default | Yes, 90 days of management events | Yes, basic metrics | Depends on the service sending logs |
| Used for | Auditing, security, compliance | Monitoring, alerting | Debugging |
What does it cost?
- Pricing model: First copy of management events: free. Additional trails ~$2/100,000 events; data events ~$0.10/100,000; CloudTrail Lake billed per GB.
- Free tier: 90 days of event history viewable free in the console.
Enabling data events for high-traffic S3 buckets or Lambda; creating multiple duplicate trails.
“Who deleted or changed a resource”, “history of API calls” → CloudTrail. Long-term, central storage → a trail for all regions and the whole organization, delivered to S3 in a separate account. Tamper-proof logs → log file validation.
Try real exam questions
1You are very concerned about security on your network because you have multiple programmers testing APIs and SDKs and you have no idea what is happening. You think CloudTrail may help but are not sure what it does. Which of the following statements best describes the AWS service CloudTrail?
- AWith AWS CloudTrail you can get a history of AWS API calls and related events for your account.
- BWith AWS CloudTrail you can get a history of IAM users for your account.
- CWith AWS CloudTrail you can get a history of S3 logfiles for your account.
- DWith AWS CloudTrail you can get a history of CloudFormation JSON scripts used for your account.
Show answer
Correct answer: A
CloudTrail records the history of API calls and related events in the account: who called what, when and from where.
Frequently asked questions
Is CloudTrail enabled by default?
Yes. Event history keeps 90 days of management events (creating, changing and deleting resources) for free in every account. To keep events longer, record data events or centralize them, create a trail that writes to S3 or use CloudTrail Lake.
What is the difference between management events and data events?
Management events are operations that manage resources, such as launching an instance or changing a security group. Data events are high-volume operations on data, such as reading or writing S3 objects or invoking Lambda; they aren't recorded by default and are charged.
How is CloudTrail priced?
The first copy of management events in each region is free. You pay for data events, additional copies of management events, Insights and CloudTrail Lake, plus the S3 storage for the log files.
What do AWS exams ask about CloudTrail?
Finding out who deleted or changed a resource, trails for all regions and for the whole organization, log file validation to detect tampering, delivering logs to a central S3 bucket in a separate account, and telling it apart from CloudWatch and AWS Config.