CloudTrail for API auditing in AWS - Step-by-Step Execution

Process Flow - CloudTrail for API auditing

User/API Call Made

↓

CloudTrail Records Event

↓

Event Stored in S3 Bucket

↓

Optional: Event Sent to CloudWatch Logs

↓

User Queries Logs for Auditing

CloudTrail watches API calls, records them, stores logs, and lets users audit actions.

Execution Sample

AWS

aws cloudtrail create-trail --name MyTrail --s3-bucket my-trail-bucket
aws cloudtrail start-logging --name MyTrail
aws s3 ls s3://my-trail-bucket/AWSLogs/

Creates a trail, starts logging API calls, and lists stored logs in S3.

Process Table

Step	Action	CloudTrail Behavior	Result
1	User makes API call (e.g., CreateBucket)	CloudTrail detects API call	Event recorded with details (user, time, action)
2	CloudTrail writes event to S3 bucket	Event stored as JSON log file	Log file available in S3 under AWSLogs/
3	User queries logs in S3 or CloudWatch	Logs retrieved for auditing	User sees who did what and when
4	No API calls made	No new events recorded	No new logs generated

💡 Execution stops when no new API calls occur, so no new events are recorded.

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	Final
API Call	None	CreateBucket	CreateBucket	CreateBucket	CreateBucket
CloudTrail Event	None	Recorded	Stored in S3	Available for query	Available for query
S3 Log Files	Empty	Contains event log	Contains event log	Contains event log	Contains event log

Key Moments - 2 Insights

Why does CloudTrail store logs in S3 instead of just showing events directly?

CloudTrail stores logs in S3 to keep a durable, searchable history of all API calls. This is shown in execution_table step 2 where events are saved as files for later auditing.

What happens if no API calls are made after enabling CloudTrail?

No new events are recorded, so no new logs appear. This is shown in execution_table step 4 where the process stops due to no activity.

Visual Quiz - 3 Questions

Look at the execution table, what does CloudTrail do at step 1?

A Deletes old log files

B Sends notification to user

C Detects and records the API call event

D Starts the S3 bucket

💡 Hint

Refer to execution_table row 1 under 'CloudTrail Behavior'

At which step are the API call events stored in S3?

A Step 1

B Step 2

C Step 3

D Step 4

💡 Hint

Check execution_table row 2 under 'Result'

If no API calls happen, what is the state of S3 log files according to variable_tracker?

A Empty

B Contains event log

C Corrupted

D Deleted

💡 Hint

Look at variable_tracker row for 'S3 Log Files' at 'Start'

Concept Snapshot

CloudTrail watches and records all API calls.
It saves logs as JSON files in an S3 bucket.
Logs can be queried for auditing user actions.
No API calls means no new logs.
Enabling CloudTrail helps track who did what and when.

Full Transcript

CloudTrail is a service that records all API calls made in your AWS account. When a user or service makes an API call, CloudTrail detects it and records details like who made the call, when, and what action was taken. These events are saved as log files in an S3 bucket you specify. You can then review these logs to audit activity and ensure security. If no API calls happen, CloudTrail simply does not create new logs. This process helps keep a clear history of all actions in your cloud environment.