How does AWS CloudTrail work for security auditing?

AWS CloudTrail is the comprehensive API activity logging service that records every action taken in your AWS account. Think of it as a security camera system for your entire AWS infrastructure — every door opened, every file accessed, every configuration changed is recorded with who did it, when, from what IP address, and whether it succeeded or failed. It is the single most important service for security auditing, compliance, and incident response.

CloudTrail captures three categories of events. Management events (also called control plane events) record operations that modify or manage AWS resources: creating an EC2 instance, modifying an IAM policy, deleting an S3 bucket, changing a security group rule. These are enabled by default on every AWS account. Data events (also called data plane events) record operations on the resources themselves: reading an object from S3, invoking a Lambda function, querying a DynamoDB table. These are not enabled by default because they generate high volume and cost. Insights events use machine learning to detect unusual API activity patterns — like a sudden spike in TerminateInstances calls that might indicate a compromised credential.

The anatomy of a CloudTrail event record contains critical forensic information. Every event includes: the event time (UTC timestamp), the event name (the specific API action like RunInstances), the event source (which AWS service, like ec2.amazonaws.com), the AWS region, the source IP address of the caller, the user identity (which IAM user, role, or AWS service made the call), the request parameters (what was requested), and the response elements (what AWS returned). For assumed roles, the event includes the role ARN, the session name, and the original identity that assumed the role — this is crucial for tracing actions back to human identities in environments that use role-based access.

CloudTrail delivers events to destinations. The primary destination is an S3 bucket, where events are stored as compressed JSON files organized by account, region, and date. A typical path looks like: s3://prod-cloudtrail-logs/AWSLogs/119283746501/CloudTrail/us-east-1/2026/06/18/. Events are delivered within approximately 5-15 minutes of the API call (this is not real-time). For near-real-time analysis, you send events to CloudWatch Logs, where you can create metric filters to trigger alarms on specific API patterns. For advanced querying, CloudTrail Lake provides a managed data lake with SQL-based querying across your event history.

Organization trails are essential for multi-account environments. An organization trail created in the management account automatically captures events from all member accounts in AWS Organizations. This gives your security team a single, centralized view of all API activity across every account. The trail writes to a central S3 bucket in the security account, and member account administrators cannot disable or modify the organization trail.

Production security patterns with CloudTrail

Unauthorized access detection: Create a CloudWatch metric filter for ConsoleLogin events where the responseElements.ConsoleLogin equals Failure. Trigger an SNS alarm when failed login attempts exceed a threshold, indicating a potential brute force attack.

Root account usage alerting: The root account should never be used for day-to-day operations. Create a metric filter for any event where userIdentity.type equals Root. Any root activity should trigger an immediate P1 alert to the security team.

Security group modification tracking: Monitor AuthorizeSecurityGroupIngress and RevokeSecurityGroupIngress events. Alert when someone opens port 22 (SSH) or port 3389 (RDP) to 0.0.0.0/0, which exposes instances to the entire internet.

IAM policy changes: Track CreatePolicy, AttachRolePolicy, PutRolePolicy, and DeletePolicy events. Any IAM change in production should go through a change management process, so out-of-band IAM modifications indicate either a process violation or compromised credentials.

Log integrity validation is critical. CloudTrail can enable log file validation, which creates a digitally signed digest file every hour. The digest contains SHA-256 hashes of all log files delivered in that period. If an attacker gains access and attempts to modify or delete CloudTrail logs to cover their tracks, the digest chain will break. You can validate the integrity using aws cloudtrail validate-logs. For defense in depth, send CloudTrail logs to a separate security account with a bucket policy that denies DeleteObject — even a compromised admin in the source account cannot delete the logs.

CloudTrail is free for management events (one copy per region). Data events and CloudTrail Lake incur charges based on the number of events. Given that a large organization can generate billions of data events monthly, be selective about which S3 buckets and Lambda functions you enable data events for — focus on sensitive data stores and critical functions rather than enabling data events globally.