AWS CloudTrail is a web service that records AWS API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service.
With CloudTrail, you can get a history of AWS API calls for your account, including API calls made via the AWS Management Console, AWS SDKs, command line tools, and higher-level AWS services (such as AWS CloudFormation). The AWS API call history produced by CloudTrail enables security analysis, resource change tracking, and compliance auditing.
Get Started with AWS for Free
Create a Free AccountOr Sign In to the Console
Receive twelve months of access to the AWS Free Usage Tier and enjoy AWS Basic Support features including, 24x7x365 customer service, support forums, and more.
CloudTrail provides increased visibility into your user activity by recording AWS API calls. You can answer questions such as, what actions did a given user take over a given time period? For a given resource, which user has taken actions on it over a given time period? What is the source IP address of a given activity? Which activities failed due to inadequate permissions?
CloudTrail uses Amazon S3 for log file storage and delivery, so log files are stored durably and inexpensively. You can use Amazon S3 lifecycle configuration rules to further reduce storage costs. For example, you can define rules to automatically delete old log files or archive them to Amazon Glacier for additional savings.
CloudTrail can be configured to publish a notification for each log file delivered, thus enabling you to automatically take action upon log file delivery. CloudTrail uses the Amazon Simple Notification Service (SNS) for notifications.
CloudTrail provides visibility of all S3 object level API calls, including Get, Put, Delete and changes to ACLs on S3 objects. You can get details, such as IAM users who made the API call, when it was made, what resources were affected, etc., for each API call.
CloudTrail can be configured to be deliver API activity to a CloudWatch Logs log group you specify. You can then create CloudWatch Alarms to receive SNS notifications when specific API activity occurs. For details, refer to the FAQS and the user guide of CloudTrail documentation.
CloudTrail can be configured to aggregate log files across multiple accounts and regions so that log files are delivered to a single bucket. For detailed instructions, refer to the Aggregating CloudTrail Log Files to a Single Amazon S3 Bucket section of the user guide.
By default, CloudTrail encrypts all log files delivered to the specified Amazon S3 bucket using Amazon S3 server-side encryption (SSE). Optionally, you can add an additional layer of security to your CloudTrail log files by encrypting the log files with your AWS Key Management Service (KMS) key. Amazon S3 will automatically decrypt your log files if you have decrypt permissions. For more details, refer to encrypting log files using your KMS key.
You can troubleshoot operational issues or perform security analysis by looking up API activity that was captured for your AWS account. Using the AWS CloudTrail console, AWS CLI, or AWS SDKs, you can quickly and easily answer questions related to API activity for the last 7 days and take immediate action. For more details, refer to this section of CloudTrail documentation for looking up API activity.
You can validate the integrity of CloudTrail log files stored in your Amazon S3 bucket and detect whether the log files were unchanged, modified, or deleted since CloudTrail delivered them to your Amazon S3 bucket. You can use the log file integrity validation as an aid in your IT security and auditing processes.
You can use the AWS API call history produced by CloudTrail as an input into log management and analysis solutions to perform security analysis and to detect user behavior patterns.
You can use the AWS API call history produced by CloudTrail to track changes to AWS resources, including creation, modification, and deletion of AWS resources such as Amazon EC2 instances, Amazon VPC security groups and Amazon EBS volumes.
CloudTrail makes it easier to ensure compliance with internal policies and regulatory standards by providing AWS API call history. For more details, see the AWS compliance whitepaper “Security at Scale: Logging in AWS.”
You can use the AWS API call history produced by CloudTrail to troubleshoot operational issues. For example, you can quickly identify the most recent changes made to resources in your environment.
CloudTrail records API activity and service events and from most AWS services. For the current list of supported services, see CloudTrail User Guide.
CloudTrail is supported in all AWS regions. For the full list of supported regions, and endpoints, see CloudTrail User Guide.
