CloudTrail for API auditing in AWS - Step-by-Step Execution

Process Flow - CloudTrail for API auditing

User/API Call Made

↓

CloudTrail Records Event

↓

Event Stored in S3 Bucket

↓

Optional: Event Sent to CloudWatch Logs

↓

User Queries Logs for Auditing

CloudTrail watches API calls, records them, stores logs, and lets users audit actions.

Execution Sample

AWS

aws cloudtrail create-trail --name MyTrail --s3-bucket my-trail-bucket
aws cloudtrail start-logging --name MyTrail
aws s3 ls s3://my-trail-bucket/AWSLogs/

Creates a trail, starts logging API calls, and lists stored logs in S3.

Process Table

Step	Action	CloudTrail Behavior	Result
1	User makes API call (e.g., CreateBucket)	CloudTrail detects API call	Event recorded with details (user, time, action)
2	CloudTrail writes event to S3 bucket	Event stored as JSON log file	Log file available in S3 under AWSLogs/
3	User queries logs in S3 or CloudWatch	Logs retrieved for auditing	User sees who did what and when
4	No API calls made	No new events recorded	No new logs generated

💡 Execution stops when no new API calls occur, so no new events are recorded.

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	Final
API Call	None	CreateBucket	CreateBucket	CreateBucket	CreateBucket
CloudTrail Event	None	Recorded	Stored in S3	Available for query	Available for query
S3 Log Files	Empty	Contains event log	Contains event log	Contains event log	Contains event log

Key Moments - 2 Insights

Why does CloudTrail store logs in S3 instead of just showing events directly?

CloudTrail stores logs in S3 to keep a durable, searchable history of all API calls. This is shown in execution_table step 2 where events are saved as files for later auditing.

What happens if no API calls are made after enabling CloudTrail?

No new events are recorded, so no new logs appear. This is shown in execution_table step 4 where the process stops due to no activity.

Visual Quiz - 3 Questions

Look at the execution table, what does CloudTrail do at step 1?

A Deletes old log files

B Sends notification to user

C Detects and records the API call event

D Starts the S3 bucket

💡 Hint

Refer to execution_table row 1 under 'CloudTrail Behavior'

At which step are the API call events stored in S3?

A Step 1

B Step 2

C Step 3

D Step 4

💡 Hint

Check execution_table row 2 under 'Result'

If no API calls happen, what is the state of S3 log files according to variable_tracker?

A Empty

B Contains event log

C Corrupted

D Deleted

💡 Hint

Look at variable_tracker row for 'S3 Log Files' at 'Start'

Concept Snapshot

CloudTrail watches and records all API calls.
It saves logs as JSON files in an S3 bucket.
Logs can be queried for auditing user actions.
No API calls means no new logs.
Enabling CloudTrail helps track who did what and when.

Full Transcript

CloudTrail is a service that records all API calls made in your AWS account. When a user or service makes an API call, CloudTrail detects it and records details like who made the call, when, and what action was taken. These events are saved as log files in an S3 bucket you specify. You can then review these logs to audit activity and ensure security. If no API calls happen, CloudTrail simply does not create new logs. This process helps keep a clear history of all actions in your cloud environment.

Practice

1. What is the primary purpose of AWS CloudTrail?

easy

A. To manage user permissions and roles

B. To store website files and images

C. To record API calls for auditing and security

D. To monitor server CPU usage

Solution

1. Step 1: Understand CloudTrail's role

   CloudTrail is designed to record all API calls made in an AWS account for auditing and security purposes.

2. Step 2: Compare other options

   The other options describe other AWS services or functions unrelated to CloudTrail's main purpose.

3. Final Answer:

   To record API calls for auditing and security -> Option C

4. Quick Check:

   CloudTrail = API call recording [OK]

Hint: CloudTrail tracks API calls, not files or CPU [OK]

Common Mistakes:

• Confusing CloudTrail with S3 storage
• Thinking CloudTrail manages permissions
• Assuming CloudTrail monitors server health

2. Which AWS service is used to store CloudTrail logs?

easy

A. Amazon S3

B. Amazon EC2

C. Amazon RDS

D. AWS Lambda

Solution

1. Step 1: Identify CloudTrail log storage

   CloudTrail stores its logs in an Amazon S3 bucket that you specify during setup.

2. Step 2: Eliminate other services

   Amazon EC2 is for virtual servers, RDS is for databases, and Lambda runs code; none store CloudTrail logs.

3. Final Answer:

   Amazon S3 -> Option A

4. Quick Check:

   CloudTrail logs go to S3 buckets [OK]

Hint: CloudTrail logs always go to S3 buckets [OK]

Common Mistakes:

• Choosing EC2 as storage
• Confusing Lambda with log storage
• Selecting RDS for logs

3. Given this CloudTrail event selector configuration:

{"ReadWriteType": "WriteOnly"}

Which API calls will CloudTrail log?

medium

A. Only read API calls

B. Only write API calls

C. Both read and write API calls

D. No API calls

Solution

1. Step 1: Understand ReadWriteType setting

   The "WriteOnly" setting means CloudTrail logs only API calls that change resources (write operations).

2. Step 2: Interpret options

   This logs only write API calls. Read-only and both read/write options include read calls, which are excluded. 'No API calls' means no logging, which is incorrect.

3. Final Answer:

   Only write API calls -> Option B

4. Quick Check:

   WriteOnly = write calls logged [OK]

Hint: WriteOnly logs only changes, not reads [OK]

Common Mistakes:

• Confusing WriteOnly with ReadOnly
• Assuming both read and write are logged
• Thinking no calls are logged

4. You configured CloudTrail but notice no logs are delivered to your S3 bucket. What is a likely cause?

medium

A. CloudTrail only logs read API calls by default

B. CloudTrail does not support logging API calls

C. CloudTrail logs are stored in EC2 instances by default

D. The S3 bucket policy blocks CloudTrail from writing logs

Solution

1. Step 1: Check S3 bucket permissions

   If the bucket policy blocks CloudTrail, logs cannot be delivered, causing no logs to appear.

2. Step 2: Eliminate incorrect causes

   CloudTrail does support logging API calls, logs are not stored on EC2 instances by default, and it logs both read and write API calls by default (not only read).

3. Final Answer:

   The S3 bucket policy blocks CloudTrail from writing logs -> Option D

4. Quick Check:

   Bucket policy must allow CloudTrail writes [OK]

Hint: Check S3 bucket policy if logs don't appear [OK]

Common Mistakes:

• Assuming CloudTrail logs to EC2
• Thinking CloudTrail doesn't log API calls
• Believing default logs are read-only

5. You want to audit only management events for your AWS account using CloudTrail. Which configuration should you use?

hard

A. Enable CloudTrail with event selectors set to log only management events

B. Enable CloudTrail with logging only data events on S3 buckets

C. Disable CloudTrail and use CloudWatch logs instead

D. Enable CloudTrail with event selectors set to log only read-only events

Solution

1. Step 1: Understand management events

   Management events track control plane operations like creating or deleting resources.

2. Step 2: Select correct event selector

   Setting event selectors to log only management events ensures auditing of these API calls.

3. Step 3: Eliminate other options

   Enable CloudTrail with logging only data events on S3 buckets logs data events, not management events. Disable CloudTrail and use CloudWatch logs instead disables CloudTrail, losing audit logs. Enable CloudTrail with event selectors set to log only read-only events logs only read-only events, missing write management events.

4. Final Answer:

   Enable CloudTrail with event selectors set to log only management events -> Option A

5. Quick Check:

   Management events = control plane API logs [OK]

Hint: Use event selectors to log management events only [OK]

Common Mistakes:

• Confusing data events with management events
• Disabling CloudTrail thinking CloudWatch suffices
• Logging only read-only events misses writes