Use AWS CloudTrail logs for security investigations

Select CloudTrail event coverage, retain audit records, validate integrity, and test queries and alerts against real event fields.

Guance Editorial Team 2026-10-27 5 min read Updated 2026-10-27

Best practices

Use AWS CloudTrail logs for security investigations

An audit trail helps establish who did what and when. In AWS, CloudTrail audit logs record supported account activity: the identity involved, time, source, action, and affected resources. It supports security investigations and audit workflows, but it is not an unconditional record of every API call. Coverage depends on the service, event type, Region, and configured selectors.

Documentation reviewed October 27, 2026. Examples are illustrative; cloud deployment, delivery, and cost tests were not performed for this article.

Key points

CloudTrail includes management, data, network activity, and Insights events. Select coverage deliberately.
Useful JSON fields include userIdentity, eventName, eventSource, sourceIPAddress, and requestParameters.
Event history provides a 90-day view of management events. For longer retention, configure a trail to S3 or, for eligible existing customers, a CloudTrail Lake event data store. CloudTrail Lake closed to new customers on May 31, 2026; this restriction does not apply to CloudTrail trails.
Test alerts for privileged access, IAM changes, public network access, and changes to the audit configuration itself. Measure notification delay.

1. Choose event coverage

Event type	Examples	Collection consideration
Management	Resource creation, policy changes, console sign-in activity	Available in regional Event history for 90 days; check trail selectors separately
Data	S3 object operations, Lambda invocation activity	Explicitly select the resource types and operations you need
Network activity	Supported API activity through VPC endpoints	Enable supported coverage explicitly; availability and selectors matter
Insights	Unusual API call or error rates for supported activity	Optional detection with its own configuration and charges

Data events can greatly exceed management-event volume, but there is no universal multiplier. Estimate volume for sensitive buckets, functions, and other resources, then choose coverage based on investigation and audit needs.

2. Read an event

This simplified JSON retains the source example's China Region:

{
  "eventTime": "2026-08-25T14:55:22Z",
  "eventSource": "iam.amazonaws.com",
  "eventName": "CreateUser",
  "awsRegion": "cn-north-1",
  "sourceIPAddress": "203.0.113.10",
  "userIdentity": {
    "type": "IAMUser",
    "userName": "admin-li",
    "accountId": "123456789012"
  },
  "requestParameters": {"userName": "new-user"},
  "responseElements": null,
  "errorCode": null
}

This is an illustrative subset, not a claim that every successful CreateUser response has null response elements. Real events contain additional fields and identity shapes, including assumed-role sessions.

To investigate a security-group change, search for AuthorizeSecurityGroupIngress and the group identifier in the event's request parameters or resource fields. Then inspect identity and source information. Do not assume a resource ID always occupies the same field in every API event.

3. Configure retention and account coverage

Trail to S3: deliver compressed JSON log files to the chosen bucket, organized by account, Region, and date.
Multi-Region coverage: include enabled Regions and review coverage when Regions or accounts change. Check partition and service availability, especially for AWS China Regions.
Organization trail: an authorized management account or delegated administrator can configure organization-level coverage. Verify membership and delivery rather than relying solely on the creation step. If the trail's home Region is opt-in, member accounts must enable that Region to send their activity to the organization trail.
Log-file integrity validation: enabling this creates digest files. Run the validation process to detect changes or missing files within its coverage; enabling the feature does not itself perform verification or make files immutable.
CloudWatch Logs delivery: configure it when metric filters and alarms are part of the workflow. Delivery is delayed, not instantaneous.

4. Query Event history or S3 with Athena

Event history is useful for recent management-event lookups in a selected Region. Its 90-day view does not include every event type or replace your trail's retention configuration.

Athena can query longer-lived S3 records after you define a suitable table and partition strategy. Restrict time and account scope to reduce scanned data. Query cost depends on bytes scanned and the chosen service pricing; it is not automatically negligible.

5. Start with security-relevant alert cases

ConsoleLogin with a root identity. Inspect the result to distinguish successful sign-in from failure.
IAM changes such as CreateUser, AttachUserPolicy, and CreateAccessKey.
Security-group ingress that opens access to 0.0.0.0/0, and IPv6 equivalents such as ::/0 where relevant.
StopLogging or DeleteTrail, which may indicate an authorized maintenance action or an attempt to reduce audit visibility.
KMS key disabling or scheduled deletion.

Apply account-specific policies and approved exceptions rather than treating every matching event as a confirmed attack.

6. Verify ingestion and notifications

Before centralizing records, inspect a known test event and confirm its time, action, account, identity, and source address. The ingestion path must download, decompress, and expand S3 log files into events. A delivered file is not yet proof that its fields are searchable.

In Guance, find the test event in the log explorer, then configure log detection against the received schema. Test a rule with a controlled sample, such as a StopLogging event, and measure elapsed time from the event timestamp to notification.

Keep original audit files in S3 according to your retention and access requirements. Configure the search copy's retention and permissions separately.

Frequently asked questions

Is 90 days enough?

That depends on investigation needs and applicable retention requirements. Choose the required period explicitly, then configure and verify long-term storage instead of relying on Event history.

Should I enable data events?

Enable the resource and operation coverage needed to investigate sensitive or important workloads. Estimate the volume and cost before expanding to all resources; ordinary resources can still require data-event coverage under your policy.

How do I cover multiple accounts?

Use an organization trail where appropriate, preserve account identifiers in the search system, and check account enrollment and exceptions. Centralized querying and event collection are separate responsibilities.

How much delivery delay should I expect?

AWS describes typical average delivery of about five minutes for ordinary CloudTrail logs to S3 and events to CloudWatch Logs, without a guaranteed delivery time. Insights has different timing. Do not assume CloudWatch delivery is always faster; measure the complete alert path.