AWS CloudTrail

AWS CloudTrail (Nov 2013) is a web service that records API calls made on your account and delivers log files to your AWS S3 bucket every 5 minutes. Third party products such as CloudCheckr and Splunk can help you to analyze logs.

Pricing:

• Management events: Always free
• Data events: 0.10 per 100,000 data events delivered

Change log

• https://aws.amazon.com/about-aws/whats-new/2020/08/aws-cloudtrail-now-provides-relevant-user-statistics-to-act-on-anomalies-detected-by-cloudtrail-insights/

Activities

• Read https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-receive-logs-from-multiple-accounts.html
• Read best practices: https://aws.amazon.com/blogs/mt/aws-cloudtrail-best-practices/

Related terms

• AWS CloudTrail Insights (Noviembre 2019)
• AWS Config
• Elastic SIEM
• IAM Access Analyzer
• AWS CloudFormation
• Governance, Compliance
• FedRAMP and PCI-DSS

See also

• Audit: acct, atop, tripwire, AIDE, auditd, debsums, AWS Cloudtrail, logwatch, logcheck, Google Santa
• Linux logging, Cisco IOS logging
• AWS CloudTrail, AWS CloudTrail Insights, CloudTrail Events, AWS CloudTrail Lake
• AWS security, AWS Security Hub, AWS CloudTrail, Amazon GuardDuty, Amazon Detective, AWS WAF, AWS Audit Manager, Amazon Fraud Detector, Cloudsploit, AWS Certified Security - Specialty, AWS Security Assurance Services, AWS GDPR, Amazon Inspector, AWS Network Firewall
• AWS, AWS Management & Governance, AWS Organizations, AWS CloudTrail, AWS Control Tower, AWS Resource Access Manager (RAM), AWS Service Catalog, AWS Landing Zone

https://aws.amazon.com/es/about-aws/whats-new/2013/11/13/announcing-aws-cloudtrail/

https://aws.amazon.com/cloudtrail/faqs/#Event_payload.2C_timeliness.2C_and_delivery_frequency

https://aws.amazon.com/blogs/aws/announcing-cloudtrail-insights-identify-and-respond-to-unusual-api-activity/