AWS CloudTrail

Audit AWS account activity with CloudTrail for compliance, security investigation, and operational troubleshooting.

When to Use

• Enabling organization-wide audit logging across all AWS accounts
• Investigating security incidents or unauthorized API activity
• Meeting compliance requirements for SOC 2, HIPAA, PCI DSS, or FedRAMP
• Setting up automated alerting on sensitive AWS API calls
• Querying historical AWS activity for forensic analysis

Prerequisites and Change Scope

Verify the AWS identity, partition, region and organization management/delegated-administrator permissions before mutation. All names, account IDs and ARNs below are synthetic placeholders; choose a globally unique owned bucket. Have a working KMS key policy permitting the selected CloudTrail trail and authorized readers, an existing CloudWatch log group and scoped role/trust policy before passing their ARNs. The snippets do not provision those dependencies. Review paid data-event/Lake/Athena scope and retention costs first. Export existing policies/selectors/lifecycle settings and merge intended changes; put-* operations can replace existing configuration. Never apply expiration to audit evidence under a legal hold.

Create an Organization Trail