AWSDOP-C02
On this page
Beginner-friendly overview

CloudTrail

CloudTrail records every API call made in your AWS account — who did what, to which resource, from where, and when. Every time someone creates an S3 bucket, modifies a security group, launches an EC2 instance, or assumes an IAM role, CloudTrail captures that event and stores it.

Why This Matters

In a shared AWS environment, understanding what happened and who did it is critical for security, compliance, and troubleshooting. CloudTrail is the answer to questions like: "Who deleted that production database?" "Which process modified this security group last night?" "Has anyone accessed this S3 bucket from an unexpected location?"

Without CloudTrail, these questions are unanswerable. With it, every action leaves an audit trail that you can search, analyze, and alert on.

The Monitoring Trifecta — memorize as WHAT / WHAT CHANGED / WHO:
CloudWatch = what is happening (high CPU) · Config = what changed in the setup (instance type modified) · CloudTrail = who did it (user "Admin_Bob" made the API call)
CloudTrail is the courtroom stenographer: it writes down every command anyone issues, verbatim — but it never interprets or intervenes.

What Gets Recorded

CloudTrail captures three categories of events:

Management events — control-plane operations: creating, modifying, and deleting AWS resources. Who launched an EC2 instance, who created an IAM role, who changed a VPC security group. These are enabled by default.

Data events — data-plane operations on specific resources: reading and writing objects in S3, invoking Lambda functions, reading from DynamoDB. These generate high volume and must be explicitly enabled.

Insights events — anomaly detection. CloudTrail analyzes your API call patterns and alerts you when it sees unusual activity, like a sudden spike in terminated EC2 instances or an unexpected surge in IAM policy changes.

Where Events Go

By default, CloudTrail delivers events to an S3 bucket. For real-time analysis, you can also route events to CloudWatch Logs (for searching and alerting) or to Amazon EventBridge (to trigger automated responses when specific API calls occur, like "run this Lambda whenever someone changes a security group").

Every API call → one CloudTrail event → delivered to every consumer API Call Admin_Bob runs DeleteBucket CloudTrail Event who · what · when · where (one JSON record) Event History 90 days · free · always on Trail → S3 + CW Logs opt-in · long-term · alerting EventBridge real-time automated response Event History and EventBridge receive events automatically — a Trail is the piece you opt into for storage beyond 90 days.

Multi-Region and Organization Trails

A trail can be scoped to one region or all regions. For complete coverage, you should always enable a multi-region trail — otherwise activity in regions you're not actively monitoring goes unrecorded.

In an AWS Organizations setup, an organization trail automatically captures events from every member account. This gives your security team a single, consistent audit log without needing to configure a trail in each account individually.