AWS CloudTrail

• Actions taken by a user, role, or an AWS service in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs are recorded as events.
• CloudTrail is enabled on your AWS account when you create it.
• CloudTrail focuses on auditing API activity.
• View events in Event History, where you can view, search, and download the past 90 days of activity in your AWS account.

• Trails

  • Create a CloudTrail trail to archive, analyze, and respond to changes in your AWS resources.

  • Types

    • A trail that applies to all regions – CloudTrail records events in each region and delivers the CloudTrail event log files to an S3 bucket that you specify. This is the default option when you create a trail in the CloudTrail console.
    • A trail that applies to one region – CloudTrail records the events in the region that you specify only. This is the default option when you create a trail using the AWS CLI or the CloudTrail API.
  • You can create an organization trail that will log all events for all AWS accounts in an organization created by AWS Organizations. Organization trails must be created in the management account.
  • By default, CloudTrail event log files are encrypted using Amazon S3 server-side encryption. You can also choose to encrypt your log files with an AWS Key Management Service key.
  • You can store your log files in your S3 bucket for as long as you want, and also define S3 lifecycle rules to archive or delete log files automatically.
  • If you want notifications about log file delivery and validation, you can set up Amazon SNS notifications.
  • CloudTrail publishes log files about every five minutes.

• Events

  • The record of an activity in an AWS account. This activity can be an action taken by a user, role, or service that is monitorable by CloudTrail.

  • Types

    • Management events
      • Logged by default
      • Management events provide insight into management operations performed on resources in your AWS account, also known as control plane operations.
    • Data events
      • Not logged by default
      • Data events provide insight into the resource operations performed on or in a resource, also known as data plane operations.
      • Data events are often high-volume activities.
• For global services such as IAM, STS, CloudFront, and Route 53, events are delivered to any trail that includes global services, and are logged as occurring in US East (N. Virginia) Region.
• You can filter logs by specifying Time range and one of the following attributes: Event name, User name, Resource name, Event source, Event ID, and Resource type.

• Monitoring

  • Use CloudWatch Logs to monitor log data. CloudTrail events that are sent to CloudWatch Logs can trigger alarms according to the metric filters you define.
  • To determine whether a log file was modified, deleted, or unchanged after CloudTrail delivered it, you can use CloudTrail log file integrity validation.

• Price

  • The first copy of management events within each region is delivered free of charge. Additional copies of management events are charged.
  • Data events are recorded and charged only for the Lambda functions and S3 buckets you specify.
  • Once a CloudTrail trail is set up, S3 charges apply based on your usage, since CloudTrail delivers logs to an S3 bucket.


• Limits

Augmenting Security & Improving Operational Health with AWS CloudTrail:

AWS CloudTrail-related Cheat Sheets:

• AWS CloudTrail vs Amazon CloudWatch

Validate Your Knowledge

Question 1

Which of the following statements is true for AWS CloudTrail?

1. CloudTrail is disabled by default for newly created AWS accounts
2. When you create a trail in the AWS Management Console, the trail applies to all AWS Regions by default
3. CloudTrail is able to capture application error logs from your EC2 instances
4. CloudTrail charges you for every management event trail created

Question 2

As part of your company’s security compliance assessment, an external IT Auditor will need to have access to the logs of all of your AWS resources such as EC2, RDS, Lambda and many others. You have to ensure that you provide ample access to enable him to conduct the audit process without the ability to trigger certain actions in your cloud architecture.

Which of the following is the most suitable way to provide access to the auditor?

1. Create an IAM User with an auto-generated password for AWS console access and then provide the details to the auditor. To allow access to the CloudTrail logs, you have to grant him the exact same IAM policies that a SysOps Administrator has.
2. Enable API logging of your AWS resources with CloudTrail then create an IAM user that has read-only access to the logs stored in the S3 bucket.
3. Create an IAM User with access keys then provide the details to the auditor.
4. Enable API logging of your AWS resources with CloudWatch then create an IAM user that has read-only access to the logs stored in the S3 bucket.

Show me the answer!

Correct Answer: 2

AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational and risk auditing of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. Events include actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs. Hence, the correct answer is to enable API logging of your AWS resources with CloudTrail then creating an IAM user that has read-only access to the logs stored in the S3 bucket.

The option that says, “Create an IAM User with an auto-generated password for AWS console access and then provide the details to the auditor. To allow access to the CloudTrail logs, you have to grant him the exact same IAM policies that a SysOps Administrator has.” is incorrect because granting the exact same IAM policies that a SysOps Administrator has is a critical security flaw. This means that the auditor can also perform the actions that the SysOps Administrator can.

The option that says, “Create an IAM User with access keys then provide the details to the auditor.” is incorrect because access keys are primarily used for sending API requests to the AWS resources.

The option that says, “Enable API logging of your AWS resources with CloudWatch then create an IAM user that has read-only access to the logs stored in the S3 bucket.” is incorrect because you should set up CloudTrail and not CloudWatch.

Reference:
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html

For more AWS practice exam questions with detailed explanations, check this out:

XX

Sources:
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/
https://aws.amazon.com/cloudtrail/features/
https://aws.amazon.com/cloudtrail/pricing/
https://aws.amazon.com/cloudtrail/faqs/