Beginner LevelCloud Computing (AWS/GCP/Azure)
What is AWS CloudTrail and how does it audit API activity across an AWS account?
❓ Interview Prompt: Explain AWS CloudTrail governance, Management Events, Data Events, Log File Integrity Validation, and S3 delivery.
AWS CloudTrail is an auditing and governance service that records all actions and API calls executed across your AWS infrastructure.
Key Capabilities:
1
Event Recording: Logs who made the API call (IAM User/Role), when (UTC timestamp), from where (Source IP), and what parameters were passed.
2
Management Events: Tracks control plane operations (e.g. 'CreateBucket', 'RunInstances', 'DeleteUser').
3
Data Events: Tracks high-volume resource operations (e.g. S3 'GetObject' or Lambda 'Invoke').
4
Log File Integrity Validation: Uses cryptographic SHA-256 digest files to detect if CloudTrail log files were modified or deleted after delivery to S3!
Code Implementation Example
hcl
# Multi-region CloudTrail configuration delivering to S3 with digest validation
resource "aws_cloudtrail" "main" {
name = "account-audit-trail"
s3_bucket_name = aws_s3_bucket.audit_logs.id
include_global_service_events = true
is_multi_region_trail = true
enable_log_file_validation = true # Digest validation against tampering
}💡Terraform multi-region CloudTrail configuration with log integrity validation.
🎯 Interview Key Takeaway
CloudTrail records every API call across your AWS account, delivering signed audit logs to S3 for security governance.
#CloudTrail#Audit Logging#Governance#Security#Beginner
Back to all Cloud Computing (AWS/GCP/Azure) Questions→