CloudTrail Logging Design

What it is

AWS CloudTrail records API activity in your accounts: who called which API, from where, when and with what result. It is the primary audit log on AWS and the starting point of almost every investigation.

A logging design has to answer four questions: what to record, where to keep it, how to protect it from tampering, and how to query it.

How it works

Event types

Event history in the console shows the last 90 days of management events at no charge. To keep events longer, to log data events, or to query across accounts, create a trail or a CloudTrail Lake event data store.

Trail design

!API calls in member accounts are recorded by an organization trail (multi Region, log file validation) that delivers to an S3 log bucket with Object Lock, versioning and SSE-KMS in a central log archive account, queried with Athena; the same events can feed CloudTrail Lake or, optionally, CloudWatch Logs, and an SCP stops members removing the trail. A trail delivers log files to an S3 bucket, and optionally to CloudWatch Logs for alarms. For security, use these options.

• Multi Region trail, so activity in unused Regions is recorded too and global service events are included.
• Organization trail, created from the management account or a delegated administrator, which logs every member account and cannot be removed by those accounts.
• Log file integrity validation, which writes signed digest files so you can prove that logs were not changed or deleted.
• SSE-KMS encryption, with a customer managed key whose policy allows CloudTrail to encrypt and your analysts to decrypt.
• A central log archive account, so an attacker who controls a workload account cannot erase the evidence.

Data events are chosen with advanced event selectors, which let you log only specific buckets or functions instead of everything. This keeps volume and cost under control.

Protecting the log bucket

The S3 bucket policy must let the CloudTrail service write, and it should scope that permission to your trail with aws:SourceArn.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AWSCloudTrailAclCheck",
      "Effect": "Allow",
      "Principal": { "Service": "cloudtrail.amazonaws.com" },
      "Action": "s3:GetBucketAcl",
      "Resource": "arn:aws:s3:::amzn-s3-demo-logs",
      "Condition": { "StringEquals": { "aws:SourceArn": "arn:aws:cloudtrail:us-east-1:111122223333:trail/org-trail" } }
    },
    {
      "Sid": "AWSCloudTrailWrite",
      "Effect": "Allow",
      "Principal": { "Service": "cloudtrail.amazonaws.com" },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::amzn-s3-demo-logs/AWSLogs/111122223333/*",
      "Condition": { "StringEquals": {
        "s3:x-amz-acl": "bucket-owner-full-control",
        "aws:SourceArn": "arn:aws:cloudtrail:us-east-1:111122223333:trail/org-trail" } }
    }
  ]
}

For an organization trail the write statement also covers the organization path. Add layers of protection around the bucket.

• Block Public Access and a deny for non secure transport.
• S3 Versioning and S3 Object Lock in compliance mode, for write once retention.
• A lifecycle rule that moves old logs to cheaper storage rather than deleting them early.
• An SCP (service control policy) that stops member accounts from stopping or deleting the trail.

Verifying integrity

Run the validation command to check that delivered logs match their digests.

# AWS CLI
aws cloudtrail validate-logs \
  --trail-arn arn:aws:cloudtrail:us-east-1:111122223333:trail/org-trail \
  --start-time 2026-01-01T00:00:00Z

Validation uses SHA-256 hashing and a digital signature on the digest files, and it reports log files that are modified, deleted or missing.

Querying logs