DJames617 AWS Service
AWS CloudTrail
CloudTrail records AWS API activity for audit, investigation, and governance.
What This Service Solves
CloudTrail records AWS API activity for audit, investigation, and governance.
- Use CloudTrail to answer who did what, from where, through which API, and when.
When You Should Not Use It
- Do not confuse CloudTrail with resource performance monitoring. It records activity, not CPU or latency metrics.
What AWS Manages and What You Manage
AWS records supported events. You manage trails, event data stores, data events, log protection, and analysis destinations.
Security Implications
Enable organization trails, protect log buckets, use digest validation where appropriate, and alert on sensitive API calls.
Availability and Scaling
CloudTrail helps reconstruct incidents. Store logs durably and centrally so attackers cannot easily erase evidence.
Management events are common; data events can be high volume. Scope data events intentionally.
Cost Behavior
Data events, Lake queries, and storage can add cost.
Common Integrations
- S3
- CloudWatch Logs
- EventBridge
- Organizations
- Security Hub
How AWS Might Present It
Certification-Specific Depth
Cloud Practitioner
Know what the service does and when it is the right family.
CloudOps Engineer Associate
Know configuration choices, integrations, failure modes, security, operations, and cost tradeoffs.
Related Comparisons
Sources and Review Metadata
This independent training application is not affiliated with or endorsed by Amazon Web Services. AWS, Amazon Web Services, and AWS certification names are trademarks of Amazon.com, Inc. or its affiliates.