AWS CloudTrail Essential2013年〜
A service that records and monitors API activity in your AWS account
What It Does
AWS CloudTrail records all API calls (operations) made within your AWS account. It captures detailed information about who performed an action, when, from which IP address, on which resource, and what the action was. Recorded logs are stored in an S3 bucket and can be used for security auditing, compliance, and troubleshooting.
Use Cases
CloudTrail is used for investigating security incidents, such as identifying who changed a security group and when, or for compliance audits where you need to provide the history of IAM policy changes over the past 90 days. It is also used to investigate unintended resource deletions and detect unauthorized access.
Everyday Analogy
Think of it like a building's security cameras. Security cameras record who enters and exits the building and which rooms they access, 24 hours a day. CloudTrail is the security camera for your AWS account, recording every operation. Just as you would rewind footage to investigate an incident, you can examine CloudTrail logs to identify the cause of a problem.
What Is CloudTrail?
AWS CloudTrail is an audit logging service that records activity within your AWS account. Operations from the AWS Management Console, AWS CLI commands, and SDK API calls are all recorded as events. CloudTrail is enabled by default, and you can view the past 90 days of event history for free.
Event Types
CloudTrail records three types of events. Management events capture resource operations such as creating, modifying, or deleting resources (launching EC2 instances, changing IAM policies, etc.). Data events capture data operations performed on resources (reading/writing S3 objects, invoking Lambda functions, etc.). Insights events automatically detect and record unusual activity patterns that differ from normal behavior.
Creating Trails and Long-Term Storage
The default event history is retained for only 90 days. For long-term storage, create a "trail" to continuously deliver logs to an S3 bucket. When you create a trail, management events are automatically saved to S3. Data events and Insights events must be explicitly enabled in the trail settings. You can also send logs to CloudWatch Logs for real-time alerting. To understand the technical background of trail creation and long-term storage, books on Amazon are a useful resource.
Getting Started
CloudTrail is enabled by default on all AWS accounts. You can immediately view the past 90 days of operation history from the "Event history" section in the CloudTrail console. If you need long-term storage or data event recording, create a trail by specifying an S3 bucket under "Create trail." To centrally manage logs across your organization, create an organization trail integrated with AWS Organizations.
Things to Watch Out For
- The default event history is only 90 days. If compliance requirements demand long-term retention, create a trail to store logs in S3
- Data events (S3 object operations, Lambda invocations, etc.) are not recorded unless explicitly enabled in a trail. Recording large volumes of data events increases costs, so narrow down the target resources
- To prevent CloudTrail log tampering, enable log file integrity validation and configure MFA Delete on the S3 bucket
