AWS CloudTrail

wikipedia:AWS CloudTrail (Nov 2013) is a web service that records API calls made on your account and delivers log files to your AWS S3 bucket every 5 minutes. Third party products such as CloudCheckr and Splunk can help you to analyze logs. Basic functionality of AWS CloudTrail is enabled on all AWS accounts by default and records up to 90 days of your account activity upon account creation by creating a trail you can extend retention period.

• Homepage: https://aws.amazon.com/cloudtrail/

Features:

• Basic funtionality enabled by default
• you can create a trail that will log events for all AWS accounts in the AWS organization

• AWS CloudTrail Insights (Nov 2019)
• AWS CloudTrail Lake (Jan 2022)

• Data exfiltration
• AWS API history
  • Logging Amazon EKS API calls with AWS CloudTrail

Pricing

• Management events: Always free
• Data events: 0.10 per 100,000 data events delivered

Change log

• Aug 2020 AWS CloudTrail Insights https://aws.amazon.com/about-aws/whats-new/2020/08/aws-cloudtrail-now-provides-relevant-user-statistics-to-act-on-anomalies-detected-by-cloudtrail-insights/

Activities

• Creating a trail for an organization with the AWS CLI: aws organizations enable-aws-service-access --service-principal cloudtrail.amazonaws.com
• Read https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-receive-logs-from-multiple-accounts.html
• Read best practices: https://aws.amazon.com/blogs/mt/aws-cloudtrail-best-practices/
• Read blog: https://aws.amazon.com/blogs/mt/category/management-tools/aws-cloudtrail/

Related terms

• AWS Config (Dec 2015)
• Amazon GuardDuty (Nov 2017) analyzes AWS CloudTrail logs
• Elastic SIEM
• IAM Access Analyzer
• Governance, Compliance, FedRAMP and PCI-DSS
• Linux acct command
• Oracle Cloud Infrastructure Audit + Oracle Cloud Logging
• Amazon EC2 Spot Instances: BidEvictedEvent event
• CloudTrail Events
• GetSecretValue
• AWS security
• AWS compliance
• AWS Governance

See also

• aws cloudtrail [ get-event-selectors | lookup-events | list-trails | create-trail | add-tags | delete-trail | describe-trails | get-trail-status | put-event-selectors | put-insight-selectors | remove-tags | start-logging | stop-logging | update-trail | validate-logs | create-event-data-store | list-public-keys | list-tags ], Terraform, enable-federation,AWS CloudTrail, Events
• AWS CloudTrail, AWS CloudTrail Insights, CloudTrail Events, AWS CloudTrail Lake, Terraform, Best practices, Datadog SIEM Content Packs for Cloudtrail

https://aws.amazon.com/es/about-aws/whats-new/2013/11/13/announcing-aws-cloudtrail/

https://aws.amazon.com/cloudtrail/faqs/#Event_payload.2C_timeliness.2C_and_delivery_frequency

https://aws.amazon.com/blogs/aws/announcing-cloudtrail-insights-identify-and-respond-to-unusual-api-activity/

https://aws.amazon.com/blogs/mt/announcing-aws-cloudtrail-lake-a-managed-audit-and-security-lake/

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/BidEvictedEvent.html