Monitoring and Logging · Topic 3 of 5

CloudTrail, Config and Auditing

Audit AWS activity and configuration with CloudTrail trails, data events, log validation and Lake, plus AWS Config rules, aggregators and timelines.

5 min

In a nutshell

CloudTrail answers who and when; Config answers what and compliance over time.
Management events are on by default with a 90 day event history.
Data events and Insights events are opt in.

What it is

Two services answer two different audit questions. AWS CloudTrail records who called which API, from where and when. AWS Config records what a resource looks like and how its configuration changed over time, and whether it complies with rules.

Together they let you reconstruct an incident: Config shows that a security group changed, and CloudTrail shows which principal made the change.

How it works

CloudTrail event types

Type	Examples	Default
Management events	Create or delete a resource, change a policy, console sign in	Recorded and viewable for 90 days in event history
Data events	S3 object reads and writes, Lambda invocations, DynamoDB item activity	Off, must be enabled per trail, higher volume
Insights events	Unusual spikes in API call rate or error rate	Off, opt in

Event history is a free, 90 day view of management events in each Region. For longer retention and for data events, create a trail that delivers to an S3 bucket and optionally to CloudWatch Logs.

Trails

A trail can cover one Region or all Regions, and an organization trail created in the management or a delegated administrator account logs every member account. Member accounts see the trail but cannot change or delete it.

CloudTrail normally delivers log files to S3 within about 5 minutes of the API call. To react quickly, send events to CloudWatch Logs or match them with Amazon EventBridge rules.

Integrity and protection

Log file integrity validation produces signed digest files, so you can prove that logs have not been altered or deleted.

aws cloudtrail validate-logs \
  --trail-arn arn:aws:cloudtrail:us-east-1:111122223333:trail/org-trail \
  --start-time 2025-01-01T00:00:00Z

Protect the log bucket with a restrictive bucket policy, SSE-KMS encryption, MFA delete or Object Lock, and keep it in a separate security or log archive account.

CloudTrail Lake

CloudTrail Lake stores events in event data stores and lets you run SQL queries directly, without building Athena tables. It can include events from many accounts and Regions through an organization event data store. For trail logs in S3, Amazon Athena is the alternative.

In a Lake query, the table name is the ID of the event data store.

SELECT eventTime, userIdentity.arn, eventName, sourceIPAddress
FROM <event-data-store-id>
WHERE eventName = 'DeleteBucket'
ORDER BY eventTime DESC
LIMIT 20

AWS Config

Config continuously records the configuration of supported resources in a configuration recorder. Each change creates a configuration item, and the history forms a timeline for the resource.

Feature	Purpose
Configuration recorder and delivery channel	Records items and delivers snapshots and history to S3
Managed rules	Prebuilt checks such as encrypted volumes or restricted SSH
Custom rules	Your own logic in Lambda or in the Guard policy language
Conformance packs	A bundle of rules and remediation actions deployed as one
Aggregator	Combines data from many accounts and Regions into one view
Advanced query	SQL like queries on the current configuration
Remediation	Runs a Systems Manager Automation runbook on noncompliant resources

Rules run when a relevant resource changes or on a schedule. A resource shows as compliant or noncompliant, and EventBridge receives compliance change events.

An organization aggregator or an organization conformance pack gives a central security account a view of every account without per account setup.

Choosing between them

Question	Use
Who deleted the bucket?	CloudTrail
Was the bucket public last Tuesday?	Config timeline
Alert me when someone changes a security group	CloudTrail event with EventBridge, or a Config rule
Show every unencrypted volume across all accounts	Config aggregator and rules
Prove logs are unaltered	CloudTrail log file validation

Other audit sources

IAM credential reports and access advisor show credential age and last used services.
VPC Flow Logs record network flows for forensic and troubleshooting work.
S3 server access logs and CloudTrail data events show object access.
AWS Audit Manager gathers evidence for frameworks, covered in the security chapter.

What to remember for the exam

CloudTrail answers who and when; Config answers what and compliance over time.
Management events are on by default with a 90 day event history.
Data events and Insights events are opt in.
An organization trail covers all accounts, and members cannot remove it.
Log file validation proves integrity through signed digest files.
Keep trail logs in a separate account with KMS and Object Lock.
Config rules can be change triggered or periodic and can auto remediate through SSM Automation.
An aggregator collects Config data across accounts and Regions.
CloudTrail Lake offers SQL queries without Athena setup.

Exam tip

To react to an API call within seconds, match the CloudTrail event with an EventBridge rule rather than waiting for the S3 log delivery.

Common mistakes

Expecting data events by default. S3 object level access is not logged until you enable it.

Using one account for workloads and audit logs. An attacker who gains admin there can alter evidence.

Mixing Config and CloudTrail roles. Config does not tell you who made a change, and CloudTrail does not store resource state.

Forgetting Regions. A single Region trail misses activity elsewhere.

Watch out

Turning on data events for every S3 bucket and Lambda function in a busy account can produce enormous log volume and cost, so scope them to sensitive resources.

Check yourself

Which service shows the configuration of a security group last month?
AWS Config, through the resource configuration timeline.
How can you prove CloudTrail logs were not modified?
Enable log file integrity validation and check the signed digest files.
Which service covers every member account in an organization with one trail?
An organization trail created from the management or delegated administrator account.

Topic 3 of 5 in Monitoring and Logging

Test yourself on Monitoring and Logging

The full AWS DOP-C02 question bank has 844 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.