Analyze your CloudTrail events using natural language in Amazon Q Console
AWS CloudTrail now integrates with Amazon Q Console, enabling natural language investigation of AWS account activity for security, compliance, and operational troubleshooting without writing queries or parsing logs.
AWS CloudTrail records API activity across an AWS account for security auditing, compliance, and operational troubleshooting. Now integrated with Amazon Q Console, it allows natural language queries about account activity. Users can ask about CloudTrail configurations, query logged events for security investigations, or troubleshoot operational issues without writing queries or manually parsing logs. The console can verify trail configurations, identify logging gaps, and confirm tracked data event sources. For security, users can inquire about users accessing specific IAM roles, VPC changes, or unauthorized access in the past week. For operations, they can ask about users creating or deleting resources, error-causing API calls, activity from specific IP addresses, or reasons for sudden cost spikes. Amazon Q Console queries CloudTrail trails, related CloudWatch log groups, and event data stores on their behalf, providing answers based on actual account activity. This integration is available in all AWS commercial regions supported by Amazon Q Console. To get started, open Amazon Q in the AWS Management Console and ask questions about CloudTrail configurations or account activity. For more information, see AWS CloudTrail documentation.
Why it matters
Enables security, compliance, and operations teams to investigate AWS account activity using natural language instead of writing queries or parsing logs.