CloudTrail for API auditing in AWS - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is AWS CloudTrail?

AWS CloudTrail is a service that records API calls made in your AWS account. It helps you track who did what, when, and from where.

beginner

Why is CloudTrail important for API auditing?

CloudTrail provides a history of API calls, which helps detect unauthorized actions, troubleshoot issues, and meet compliance requirements.

intermediate

What types of events does CloudTrail record?

CloudTrail records management events (like creating or deleting resources) and data events (like reading or writing data in S3 buckets).

intermediate

How does CloudTrail deliver logs?

CloudTrail delivers logs to an Amazon S3 bucket you specify. You can also send logs to CloudWatch Logs for real-time monitoring.

advanced

What is a best practice when setting up CloudTrail for API auditing?

Enable multi-region trails to capture API activity across all regions, and protect your S3 bucket with proper permissions to secure your logs.

What does AWS CloudTrail primarily record?

A API calls made in your AWS account

B CPU usage of EC2 instances

C Network traffic between AWS services

D Billing and cost reports

CloudTrail records API calls, which helps track user activity and changes in your AWS environment.

Where does CloudTrail store its log files by default?

A AWS Lambda function

B Amazon RDS database

C Amazon S3 bucket

D Amazon DynamoDB table

CloudTrail delivers logs to an Amazon S3 bucket you specify for storage and analysis.

Which CloudTrail event type records actions like reading data from an S3 bucket?

A Data events

B Billing events

C Management events

D Security events

Data events include operations on resources like reading or writing data in S3 buckets.

Why should you enable multi-region trails in CloudTrail?

A To automatically fix security issues

B To reduce storage costs

C To speed up EC2 instance launches

D To capture API activity across all AWS regions

Multi-region trails ensure you capture API calls made in any AWS region, giving a complete audit trail.

How can you monitor CloudTrail logs in real time?

A Store logs in Amazon S3 only

B Send logs to Amazon CloudWatch Logs

C Use AWS Config

D Enable AWS Shield

Sending CloudTrail logs to CloudWatch Logs allows real-time monitoring and alerting on API activity.

Explain how AWS CloudTrail helps with API auditing and security.

Think about how tracking actions helps keep your cloud safe.

Describe best practices for setting up CloudTrail to ensure effective API auditing.

Consider how to get complete logs and keep them safe.