devuplabs.cloud
Log inSign up
Architecture note2 lab guides2 lab guides

CloudTrail · AWS CloudTrail

API audit logs, trails vs Event history, management and data events, and the StopLogging failure that goes unnoticed until the investigation.

Outcome

  • Trails, Lookups & Data Events
    • Created an S3 log bucket with a CloudTrail-only write policy
    • Created a multi-region trail with log file validation
    • Started logging and read GetTrailStatus
    • Looked up CreateBucket in Event history before S3 delivery
    • Confirmed log objects under AWSLogs/.../CloudTrail/
    • Added a scoped S3 data-event selector (not *)
    • Generated PutObject data-plane activity
    • Attached CloudWatch Logs delivery with a dedicated IAM role
    • Created a metric filter and alarm for StopLogging / DeleteTrail
    • Stopped logging and showed Event history still records the call
    • Broke the bucket policy and observed LatestDeliveryError
    • Listed digest prefixes and ran validate-logs
    • Cleaned up the trail, log group, role, and buckets

Unlock all 32 AWS services & 353+ lab sessions (~225 hours)

Pricing