Audit Log Design and Operations - Complete API Activity Recording with CloudTrail
Learn how to design audit logs using AWS CloudTrail, including recording API activity, long-term storage in S3, and compliance automation through integration with AWS Config.
The Need for Audit Logs in Cloud Environments
In cloud environments, accurately recording who performed what operation on which resource and when is the foundation of security and compliance. AWS CloudTrail is a service that automatically records API calls within an AWS account and can include both management events (console operations, CLI commands, SDK calls) and data events (S3 object access, Lambda function invocations) in what it records. CloudTrail is automatically enabled when an AWS account is created, and you can view the past 90 days of event history for free. By configuring trail delivery to S3, CloudTrail enables indefinite log retention, and integration with Organizations allows centralized management of audit logs spanning hundreds of accounts. CloudTrail is used as the foundation for audit trails in meeting regulatory requirements such as SOC 2, PCI DSS, and HIPAA. To check recent events via the CLI, run a command like aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=ConsoleLogin --max-results 5.
Trail Configuration and Long-Term Storage in S3
By creating a CloudTrail trail, you can continuously deliver event logs to an S3 bucket, enabling long-term storage beyond 90 days. Trails can be configured for a single region or all regions; enabling a multi-region trail lets you also capture operations on globally deployed resources. Log files stored in S3 can be encrypted with SSE-KMS, and together with bucket policies and access logs this helps guard against tampering. When you enable log file integrity validation, CloudTrail generates digests for log files, allowing you to cryptographically verify that files have not been tampered with. Combined with S3 lifecycle policies, you can automatically transition logs to Glacier after a specified period, lowering long-term storage costs. To create a trail via the CLI, run aws cloudtrail create-trail --name my-org-trail --s3-bucket-name my-audit-bucket --is-multi-region-trail --enable-log-file-validation, where the --enable-log-file-validation option enables log integrity verification.
CloudTrail Lake and Advanced Query Analysis
CloudTrail Lake (no longer accepting new customers as of May 31, 2026) is a managed data lake that lets you query audit logs directly using SQL. In contrast to analyzing logs stored in S3 with Athena, CloudTrail Lake lets you handle everything from log ingestion to querying within a single service. Depending on the pricing option, event data stores can retain logs for up to 10 years (one-year extendable retention pricing) or 7 years (seven-year retention pricing), with configurable retention periods to meet compliance requirements. SQL queries let you flexibly analyze specific IAM user activity histories, access patterns for specific resources, privilege escalation attempts, and more. The dashboard feature visualizes query results, enabling security teams to build workflows for generating regular audit reports. Organizations integration aggregates events from across the organization into a single data store for cross-cutting analysis.
Compliance Automation Through Config Integration
Combining CloudTrail with AWS Config lets you build a comprehensive audit framework that correlates resource configuration change history with API operation history. Config continuously records resource configuration states and uses Config Rules to automatically evaluate whether configurations comply with policies. For example, if public access is enabled on an S3 bucket, Config detects the non-compliance, and CloudTrail logs identify who made the change and when. Using Config conformance packs, you can apply rule sets based on industry standards such as PCI DSS and CIS Benchmark in bulk, which can be used to automate compliance evaluation. By configuring remediation actions, you can also automatically correct non-compliant resources, automating the maintenance of your security posture.
CloudTrail Pricing
The first trail for management events is free, and additional trails cost approximately $2.00 per 100,000 events (as of October 2026). Data events cost approximately $0.10 per 100,000 events. CloudTrail Lake charges for ingestion and queries (approximately $0.005 per GB scanned); under one-year extendable retention pricing, ingestion of CloudTrail events costs approximately $0.75 per GB, and retention beyond the first year costs approximately $0.023 per GB per month. Limit data event targets to sensitive buckets and critical Lambda functions rather than applying them uniformly across all resources to manage costs.
Summary
AWS CloudTrail serves as the foundation for audit logging in cloud environments, automatically recording API activity and supporting efforts to meet security and compliance requirements. Long-term storage in S3 with integrity validation is used to detect tampering and to back up the reliability of logs as evidence. If you already use CloudTrail Lake, you can analyze audit logs directly with SQL queries. Integration with AWS Config enables end-to-end automation from configuration change detection to root cause identification and automatic remediation, which helps reduce the burden of compliance operations. For organizations looking to strengthen their audit log design and operations, a setup that combines AWS audit capabilities centered on CloudTrail is one option.
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
- AWS CloudTrail official page
- Amazon S3 official page
- AWS Config official page
- AWS Documentation (official)
If this page and the official documentation disagree, treat the official documentation as authoritative.