AWS CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. With CloudTrail, you can log, continuously monitor, and retain events related to API calls across your AWS infrastructure. CloudTrail provides a history of AWS API calls for your account, including API calls made through the AWS Management Console, AWS SDKs, command line tools, and other AWS services. This history simplifies security analysis, resource change tracking, and troubleshooting.
Simplified Compliance
With AWS CloudTrail, simplify your compliance audits by automatically recording and storing activity logs for actions made within your AWS account. Integration with Amazon CloudWatch Logs provides a convenient way to search through log data, identify out-of-compliance events, accelerate incident investigations, and expedite responses to auditor requests.
Visibility Into User and Resource Activity
AWS CloudTrail increases visibility into your user and resource activity by recording AWS API calls. You can identify which users and accounts called AWS, the source IP address from which the calls were made, and when the calls occurred.
Security Analysis and Troubleshooting
With AWS CloudTrail, you can discover and troubleshoot security and operational issues by capturing a comprehensive history of changes that occurred in your AWS account within a specified period of time.
Security Automation
AWS CloudTrail allows you track and automatically respond to API activity threatening the security of your AWS resources. With Amazon CloudWatch Events integration, you can define workflows that execute when events that can result in security vulnerabilities are detected. For example, if CloudTrail logs an API call that marks an Amazon S3 Bucket public, you can use CloudWatch Events to add a specific policy on that bucket using an AWS Lambda function.
AWS CloudTrail makes it easier to ensure compliance with internal policies and regulatory standards by providing a history of all API calls in your AWS account. For more information, download the AWS compliance whitepaper, “Security at Scale: Logging in AWS.”
Learn how Siemens built a HIPAA-Compliant application using AWS CloudTrail and other AWS services here.
You can perform security analysis and detect user behavior patterns by ingesting AWS CloudTrail API call history into your log management and analytics solutions.
You can detect data exfiltration by collecting activity data on S3 objects through object-level API events recorded in CloudTrail. After the activity data is collected, you can use other AWS services, such as Amazon CloudWatch Events and AWS Lambda, to trigger response procedures.
You can troubleshoot operational issues by leveraging the AWS API call history produced by AWS CloudTrail. For example, you can quickly identify the most recent changes made to resources in your environment, including creation, modification, and deletion of AWS resources (e.g., Amazon EC2 instances, Amazon VPC security groups, and Amazon EBS volumes).
