What is AWS CloudTrail?

How Does AWS CloudTrail Work?

AWS CloudTrail records activity as events, and organizes them into a few categories:

• Management events: Control plane actions like creating an AWS S3 bucket, launching an AWS EC2 instance, or modifying an AWS IAM policy.
• Data events: Data plane actions like reading an AWS S3 object, invoking a Lambda function, or a DynamoDB item-level operation.
• Network activity events: Actions taken through VPC endpoints from a private VPC to AWS services.

By default, AWS CloudTrail keeps a 90-day Event History of management events at no cost, viewable directly in the console. For longer retention or broader event coverage, you can create a trail that delivers events continuously to an Amazon S3 bucket and optionally to AWS CloudWatch Logs or EventBridge for real-time processing. An organization trail extends this across every account in an AWS Organization from a single management account.

What Are the Key Features of AWS CloudTrail?

• Event History: A 90-day, no-setup-required log of management events, searchable directly in the console.
• Trails: Continuous, configurable delivery of events to AWS S3, with support for multi-region and organization-wide aggregation.
• AWS CloudTrail Insights: Anomaly detection that flags unusual API call volume or error rates without manual threshold-setting.
• Log file integrity validation: Digitally signed, tamper-evident logs that prove a log file hasn't been altered after delivery.
• AWS CloudWatch and EventBridge integration: Event-driven alerting and automated responses to specific API activity.
• Data event logging: Granular logging for high-volume services like AWS S3, AWS Lambda, and DynamoDB, enabled selectively to control cost.

What Are the Use Cases of AWS CloudTrail?

AWS CloudTrail is used across security, compliance, and operations teams for a few recurring jobs:

• Security investigation: Reconstructing exactly what an identity did during a suspected compromise.
• Compliance auditing: Producing the activity evidence required for frameworks like SOC 2, HIPAA, or PCI-DSS.
• Operational troubleshooting: Tracing who changed a resource's configuration right before an incident.
• Infrastructure drift detection: Catching manual console changes that diverge from an Infrastructure-as-Code baseline.
• Cost anomaly investigation: Tracing a sudden cost spike back to the specific identity, API call, or resource change that caused it.

What Are the Limitations of AWS CloudTrail?

• Event history covers only management events, is capped at 90 days, and can't be extended without creating a trail.
• CloudTrail isn't a real-time alerting tool on its own, since it needs Amazon CloudWatch or AWS EventBridge on top for live notifications.
• Data events, Insights, and additional trail copies are billed separately, and can grow unpredictably at scale.
• It doesn't capture full request/response payloads for every service, which limits how deep an investigation can go from logs alone.
• AWS CloudTrail Lake, the managed query layer for CloudTrail data, is closed to new customers as of May 31, 2026.

What Is the Pricing Model of AWS CloudTrail?

Frequently Asked Questions

• Q1: What is the alternative to AWS CloudTrail?

  Within AWS, Amazon CloudWatch is now the recommended path for capabilities that used to sit in CloudTrail Lake, including centralized log analytics and querying. Outside AWS, most enterprise teams pair AWS CloudTrail with a SIEM tool (like Splunk or Datadog) for cross-cloud correlation, since CloudTrail itself only covers AWS activity.

• Q2: Is AWS CloudTrail free?

  The first copy of management events per region is free, and Event History (90 days of management events) requires no setup. Data events, additional event copies, Insights, and S3 trail storage are billed separately.

• Q3: What is the difference between AWS CloudTrail and Amazon CloudWatch?

  AWS CloudTrail records API calls and account activity. Amazon CloudWatch monitors system behavior across metrics, logs, and alarms on resource performance.CloudTrail events are often routed into CloudWatch for real-time alerting.

• Q4: How long does AWS CloudTrail retain logs?

  Event History retains 90 days by default. Trails have no retention limit on their own, since events are delivered to an S3 bucket you control, so retention depends on your S3 lifecycle policy.

• Q5: Is AWS CloudTrail enabled by default?

  Event History is enabled automatically for every AWS account. You must create trails manually to extend logging beyond 90 days and beyond management events alone.