AWS First Steps
New feature

Analyze your CloudTrail events using natural language in Amazon Q Console

AWS CloudTrail now integrates with Amazon Q Console, enabling natural language investigation of AWS account activity, including CloudTrail configuration checks, security investigations, and operational troubleshooting.

AWS CloudTrail records API activity across an entire AWS account for security auditing, compliance, and operational troubleshooting. Now integrated with Amazon Q Console, it allows natural language queries into account activity. Users can ask about CloudTrail configurations, query logged events for security investigations, or troubleshoot operational issues without manually parsing logs. The console verifies trail configurations, identifies logging gaps, and confirms tracked data event sources. For security, users can inquire about users accessing specific IAM roles, VPC configuration changes, or recent unauthorized access attempts. For operations, they can examine users creating or deleting resources, API calls causing errors, activity from specific IP addresses, or reasons for sudden cost spikes. Amazon Q Console queries CloudTrail trails, related CloudWatch log groups, and event data stores on their behalf, delivering responses based on actual account activity. This integration is available in all AWS commercial regions supported by Amazon Q Console. To get started, open Amazon Q in the AWS Management Console and ask questions about CloudTrail settings or account activity. For more information, see AWS CloudTrail documentation.

Why it matters

For users who use CloudTrail for security auditing, compliance, and operational troubleshooting. Natural language queries eliminate the need for specialized query knowledge.

Read the original AWS announcement

Related articles and terms

AWS CloudTrailAutomatically records all API calls in your AWS account, enabling you to track who did what and when for auditing and securityAPI Audit Logging with AWS CloudTrail - Trail Design and Security AnalysisRecord all API activity and run advanced analysis with SQL queries in CloudTrail Lake. This article covers automatic anomaly detection with Insights and real-time detection through EventBridge integration.Audit Log Design and Operations - Complete API Activity Recording with CloudTrailLearn how to design audit logs using AWS CloudTrail, including recording API activity, long-term storage in S3, and compliance automation through integration with AWS Config.CloudTrail Sees Everything - How API Calls Are Recorded and Practical Forensic InvestigationThis article explains how CloudTrail records AWS API calls, the differences between management events and data events, SQL analysis with CloudTrail Lake, and forensic investigation techniques when a security incident occurs.AWS Incident Response Toolchain - An Integrated Investigation Platform from CloudTrail to Security HubExplore the AWS incident response toolchain combining CloudTrail, Config, Detective, and Security Hub, and compare the investigation approach with Azure Sentinel.