Bird
Raised Fist0
AWScloud~5 mins

CloudTrail for API auditing in AWS - Commands & Configuration

Choose your learning style10 modes available
LearnWhyDeepVisualTryChallengeProjectRecallTime
Introduction
When you want to know who did what in your AWS account, CloudTrail helps by recording all the actions taken through the AWS API. It keeps a history of these actions so you can check them later for security or troubleshooting.
When you want to track changes made to your AWS resources by users or services.
When you need to investigate a security incident by seeing who accessed or changed something.
When you want to keep a record of all API calls for compliance or auditing purposes.
When you want to monitor usage patterns of your AWS environment over time.
When you want to receive alerts or automate responses based on specific API activities.
Config File - cloudtrail.json
cloudtrail.json
{
  "TrailName": "example-trail",
  "S3BucketName": "example-cloudtrail-logs-bucket",
  "IncludeGlobalServiceEvents": true,
  "IsMultiRegionTrail": true,
  "EnableLogFileValidation": true
}

TrailName: The name of your CloudTrail trail.

S3BucketName: The bucket where CloudTrail stores log files.

IncludeGlobalServiceEvents: Records global services like IAM events.

IsMultiRegionTrail: Tracks API calls across all AWS regions.

EnableLogFileValidation: Ensures log files are not tampered with.

Commands
Create an S3 bucket to store CloudTrail logs. This bucket will hold all the recorded API activity files.
Terminal
aws s3 mb s3://example-cloudtrail-logs-bucket
Expected OutputExpected
make_bucket: example-cloudtrail-logs-bucket
Create a CloudTrail trail named 'example-trail' that records API calls from all regions, includes global services, and validates log files.
Terminal
aws cloudtrail create-trail --name example-trail --s3-bucket-name example-cloudtrail-logs-bucket --include-global-service-events --is-multi-region-trail --enable-log-file-validation
Expected OutputExpected
{ "Name": "example-trail", "S3BucketName": "example-cloudtrail-logs-bucket", "IncludeGlobalServiceEvents": true, "IsMultiRegionTrail": true, "LogFileValidationEnabled": true }
→
--include-global-service-events - Includes global AWS service events like IAM.
→
--is-multi-region-trail - Tracks API calls across all AWS regions.
→
--enable-log-file-validation - Ensures logs are secure and untampered.
Start recording API activity for the trail you created.
Terminal
aws cloudtrail start-logging --name example-trail
Expected OutputExpected
No output (command runs silently)
Check the details of your CloudTrail trail to confirm it is set up correctly.
Terminal
aws cloudtrail describe-trails --trail-name-list example-trail
Expected OutputExpected
{ "trailList": [ { "Name": "example-trail", "S3BucketName": "example-cloudtrail-logs-bucket", "IncludeGlobalServiceEvents": true, "IsMultiRegionTrail": true, "LogFileValidationEnabled": true } ] }
View the last 5 recorded API events to see what actions have been logged.
Terminal
aws cloudtrail lookup-events --max-results 5
Expected OutputExpected
{ "Events": [ { "EventId": "12345678-1234-1234-1234-123456789012", "EventName": "ConsoleLogin", "Username": "alice", "EventTime": "2024-06-01T12:00:00Z" }, { "EventId": "87654321-4321-4321-4321-210987654321", "EventName": "CreateBucket", "Username": "bob", "EventTime": "2024-06-01T11:50:00Z" } ] }
→
--max-results - Limits the number of events returned.
Key Concept

If you remember nothing else from this pattern, remember: CloudTrail records every API action in your AWS account so you can see who did what and when.

Common Mistakes
Not creating or specifying an S3 bucket for CloudTrail logs.
CloudTrail needs a place to store logs; without a bucket, it cannot save the recorded events.
Always create an S3 bucket first and specify it when creating the CloudTrail trail.
Forgetting to start logging after creating the trail.
Creating a trail alone does not start recording; you must explicitly start logging to capture events.
Run 'aws cloudtrail start-logging' with your trail name to begin capturing API activity.
Not enabling multi-region trails when you have resources in multiple regions.
Without multi-region enabled, CloudTrail only records events in the region where the trail was created, missing others.
Use the --is-multi-region-trail flag to capture API calls from all regions.
Summary
Create an S3 bucket to store CloudTrail logs.
Create a CloudTrail trail specifying the bucket and enabling global and multi-region events.
Start logging to begin recording API activity.
Verify the trail setup and view recent API events.

Practice

(1/5)
1. What is the primary purpose of AWS CloudTrail?
easy
A. To manage user permissions and roles
B. To store website files and images
C. To record API calls for auditing and security
D. To monitor server CPU usage

Solution

  1. Step 1: Understand CloudTrail's role

    CloudTrail is designed to record all API calls made in an AWS account for auditing and security purposes.

  2. Step 2: Compare other options

    The other options describe other AWS services or functions unrelated to CloudTrail's main purpose.

  3. Final Answer:

    To record API calls for auditing and security -> Option C

  4. Quick Check:

    CloudTrail = API call recording [OK]
Hint: CloudTrail tracks API calls, not files or CPU [OK]
Common Mistakes:
  • Confusing CloudTrail with S3 storage
  • Thinking CloudTrail manages permissions
  • Assuming CloudTrail monitors server health
2. Which AWS service is used to store CloudTrail logs?
easy
A. Amazon S3
B. Amazon EC2
C. Amazon RDS
D. AWS Lambda

Solution

  1. Step 1: Identify CloudTrail log storage

    CloudTrail stores its logs in an Amazon S3 bucket that you specify during setup.

  2. Step 2: Eliminate other services

    Amazon EC2 is for virtual servers, RDS is for databases, and Lambda runs code; none store CloudTrail logs.

  3. Final Answer:

    Amazon S3 -> Option A

  4. Quick Check:

    CloudTrail logs go to S3 buckets [OK]
Hint: CloudTrail logs always go to S3 buckets [OK]
Common Mistakes:
  • Choosing EC2 as storage
  • Confusing Lambda with log storage
  • Selecting RDS for logs
3. Given this CloudTrail event selector configuration:
{"ReadWriteType": "WriteOnly"}

Which API calls will CloudTrail log?
medium
A. Only read API calls
B. Only write API calls
C. Both read and write API calls
D. No API calls

Solution

  1. Step 1: Understand ReadWriteType setting

    The "WriteOnly" setting means CloudTrail logs only API calls that change resources (write operations).

  2. Step 2: Interpret options

    This logs only write API calls. Read-only and both read/write options include read calls, which are excluded. 'No API calls' means no logging, which is incorrect.

  3. Final Answer:

    Only write API calls -> Option B

  4. Quick Check:

    WriteOnly = write calls logged [OK]
Hint: WriteOnly logs only changes, not reads [OK]
Common Mistakes:
  • Confusing WriteOnly with ReadOnly
  • Assuming both read and write are logged
  • Thinking no calls are logged
4. You configured CloudTrail but notice no logs are delivered to your S3 bucket. What is a likely cause?
medium
A. CloudTrail only logs read API calls by default
B. CloudTrail does not support logging API calls
C. CloudTrail logs are stored in EC2 instances by default
D. The S3 bucket policy blocks CloudTrail from writing logs

Solution

  1. Step 1: Check S3 bucket permissions

    If the bucket policy blocks CloudTrail, logs cannot be delivered, causing no logs to appear.

  2. Step 2: Eliminate incorrect causes

    CloudTrail does support logging API calls, logs are not stored on EC2 instances by default, and it logs both read and write API calls by default (not only read).

  3. Final Answer:

    The S3 bucket policy blocks CloudTrail from writing logs -> Option D

  4. Quick Check:

    Bucket policy must allow CloudTrail writes [OK]
Hint: Check S3 bucket policy if logs don't appear [OK]
Common Mistakes:
  • Assuming CloudTrail logs to EC2
  • Thinking CloudTrail doesn't log API calls
  • Believing default logs are read-only
5. You want to audit only management events for your AWS account using CloudTrail. Which configuration should you use?
hard
A. Enable CloudTrail with event selectors set to log only management events
B. Enable CloudTrail with logging only data events on S3 buckets
C. Disable CloudTrail and use CloudWatch logs instead
D. Enable CloudTrail with event selectors set to log only read-only events

Solution

  1. Step 1: Understand management events

    Management events track control plane operations like creating or deleting resources.

  2. Step 2: Select correct event selector

    Setting event selectors to log only management events ensures auditing of these API calls.

  3. Step 3: Eliminate other options

    Enable CloudTrail with logging only data events on S3 buckets logs data events, not management events. Disable CloudTrail and use CloudWatch logs instead disables CloudTrail, losing audit logs. Enable CloudTrail with event selectors set to log only read-only events logs only read-only events, missing write management events.

  4. Final Answer:

    Enable CloudTrail with event selectors set to log only management events -> Option A

  5. Quick Check:

    Management events = control plane API logs [OK]
Hint: Use event selectors to log management events only [OK]
Common Mistakes:
  • Confusing data events with management events
  • Disabling CloudTrail thinking CloudWatch suffices
  • Logging only read-only events misses writes
Recommended

Ready to prove it?

Pass the test and this pattern moves unknown strong while earning +1 Grip toward your certificate.

10 questions~5 mineasy hard