AWS CloudTrail

Audit AWS account activity with CloudTrail for compliance, security investigation, and operational troubleshooting.

When to Use

• Enabling organization-wide audit logging across all AWS accounts
• Investigating security incidents or unauthorized API activity
• Meeting compliance requirements for SOC 2, HIPAA, PCI DSS, or FedRAMP
• Setting up automated alerting on sensitive AWS API calls
• Querying historical AWS activity for forensic analysis

Create an Organization Trail

# Create the S3 bucket for log storage
aws s3api create-bucket \
  --bucket org-cloudtrail-audit-logs \
  --region us-east-1