CloudTrail

A record of every AWS API call. Who did what, when, from where.

Think of it as: The building's CCTV and visitor book.

What to know for Level 0

CloudTrail records AWS API calls: who, what, when and from where. Console, CLI and SDK actions are all API calls, and failed calls are recorded too.
Event history keeps 90 days of management events in each Region, with no setup.
A trail saves events to S3 for as long as you like. An organization trail, created from the management account, covers every account and Region, and member accounts can't change or stop it.
By default only management events (like creating a bucket) are logged. Data events, such as S3 object reads or DynamoDB item reads, have to be turned on.

More detail

Every console click, CLI command and SDK call is an API call, and CloudTrail logs it, including failed ones. Event history keeps 90 days of management events per Region for free. A trail saves them to S3 for as long as you like. An organization trail covers every account and Region in one go. By default it logs management events (like CreateDBInstance) but not data events (like S3 object reads), and it never sees what happens inside a database.

Quiz yourself on CloudTrail →

← All terms