73. AWS CloudTrail

Overview

• AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational and risk auditing of your AWS account.
• Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail.
• Events include actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs.
• Visibility into your AWS account activity is a key aspect of security and operational best practices. You can use CloudTrail to view, search, download, archive, analyze, and respond to account activity across your AWS infrastructure.
• Optionally, you can enable AWS CloudTrail Insights on a trail to help you identify and respond to unusual activity.

How CloudTrail works

• CloudTrail is enabled on your AWS account when you create it.
• When activity occurs in your AWS account, that activity is recorded in a CloudTrail event.
• You can easily view events in the CloudTrail console by going to Event history.
• Event history allows you to view, search, and download the past 90 days of activity in your AWS account.
• In addition, you can create a CloudTrail trail to archive, analyze, and respond to changes in your AWS resources.
• A trail is a configuration that enables delivery of events to an Amazon S3 bucket that you specify. You can also deliver and analyze events in a trail with Amazon CloudWatch Logs and Amazon CloudWatch Events.
• You can create two types of trails for an AWS account:
  • A trail that applies to all regions
  • A trail that applies to one region
  • If you create a trail that logs events in all AWS Regions, it will appear in the console in all AWS Regions. If you create a trail that only logs events in a single AWS Region, you can view and manage it only in that AWS Region
  • If you have created an organization in AWS Organizations, you can also create a trail that will log all events for all AWS accounts in that organization. This is referred to as an organization trail.
    • Organization trails can apply to all AWS Regions or one Region
    • Organization trails must be created in the management account
    • Member accounts will be able to see the organization trail, but cannot modify or delete it
• By default, CloudTrail event log files are encrypted using Amazon S3 server-side encryption (SSE). You can also choose to encrypt your log files with an AWS Key Management Service (AWS KMS) key. 

CloudTrail concepts

• An event in CloudTrail is the record of an activity in an AWS account.
  • This activity can be an action taken by a user, role, or service that is monitorable by CloudTrail.
  • CloudTrail events provide a history of both API and non-API account activity made through the AWS Management Console, AWS SDKs, command line tools, and other AWS services.
  • There are three types of events that can be logged in CloudTrail:
    • management events: management operations that are performed on resources in your AWS account
    • data events: resource operations performed on or in a resource
    • CloudTrail Insights events: CloudTrail Insights events capture unusual API call rate or error rate activity in your AWS account. 
  • By default, trails log management events, but not data or Insights events.
• CloudTrail event history provides a viewable, searchable, and downloadable record of the past 90 days of CloudTrail events.
• A trail is a configuration that enables delivery of CloudTrail events to an Amazon S3 bucket, CloudWatch Logs, and CloudWatch Events.
• An organization trail is a configuration that enables delivery of CloudTrail events in the management account and all member accounts in an AWS Organizations organization to the same Amazon S3 bucket, CloudWatch Logs, and CloudWatch Events.
• CloudTrail Lake lets you run fine-grained SQL-based queries on your events.
• Integration with CloudWatch Logs enables CloudTrail to send events containing API activity in your AWS account to a CloudWatch Logs log group. 
• You can optionally configure CloudWatch alarms to send notifications or make changes to the resources that you are monitoring based on log stream events that your metric filters extract.
• In CloudWatch Events, you can create rules that trigger on any event recorded by CloudTrail. 

AWS service integrations 

• Using Athena with CloudTrail logs is a powerful way to enhance your analysis of AWS service activity. 
• You can configure CloudTrail with CloudWatch Logs to monitor your trail logs and be notified when specific activity occurs.
• You can create a trail in the management account for an organization that collects all event data for all AWS accounts in an organization in AWS Organizations.

Reference

What Is AWS CloudTrail? - AWS CloudTrail