CloudTrail
Definition
AWS service that records every control-plane API call across an AWS account, with the principal, source IP, action, target resource and timestamp. Equivalent services are Azure Activity Log and GCP Cloud Audit Logs. The first stop in any cloud incident reconstruction.
- Provider
- Amazon Web Services
- Records
- Control-plane API calls
- Captured fields
- Principal, source IP, action, resource, timestamp
- Equivalents
- Azure Activity Log, GCP Cloud Audit Logs
Common questions
Why is CloudTrail usually the first thing examined in an AWS incident?+
Because it records every API call made to the account regardless of which service was touched, it gives investigators a single chronological record of who did what across the whole environment, letting them establish an initial timeline before diving into service-specific logs.
Can an attacker with sufficient privileges disable or tamper with CloudTrail?+
Yes if they gain the right permissions, which is why security baselines recommend sending CloudTrail logs to a separate, restricted-access storage location and enabling log file integrity validation so tampering or deletion attempts are detectable even if the trail itself is disabled.
Related terms
- CERT-in Direction April 2022
- Direction issued under Section 70B(6) of the IT Act 2000 requiring 6-hour incident reporting, 180-day log retention in India, KYC retention by...
- EBS Snapshot
- A point-in-time, block-level copy of an EBS volume stored in S3. Snapshots are incremental, encrypted if the source volume is encrypted, and...
- MLAT
- Mutual Legal Assistance Treaty. The formal mechanism for cross-border evidence requests. India has bilateral MLATs with over 40 countries including the US,...
- NIST IR 8006
- The August 2020 NIST Interagency Report titled NIST Cloud Computing Forensic Science Challenges. Catalogues 65 challenges across nine categories: architecture, data collection,...
- Significant Social Media Intermediary
- Under IT Rules 2021, an intermediary providing services with more than 50 lakh (5 million) registered users in India. Triggers additional obligations:...