CloudTrail

AWS CloudTrail records API calls made in your AWS account - every action taken through the console, CLI, SDK, or by AWS services. Each event includes who made the call, what action they performed, which resources were affected, when it happened, and from what IP address.

Event Types

• Management events: control plane operations (CreateBucket, RunInstances, PutBucketPolicy). Logged by default in event history (90 days free).
• Data events: data plane operations (GetObject, PutObject, Invoke). Must be explicitly enabled on a trail. Higher volume and cost.
• Insights events: CloudTrail detects unusual API activity patterns automatically

Security Use Cases

• Incident investigation - who deleted that resource?
• Compliance auditing - prove who accessed what
• Real-time alerting via CloudWatch or EventBridge
• Integration with Athena for SQL queries over historical logs