AWS CloudTrail is a fully-managed, serverless service that gives us the ability to collect an audit log of all API calls to AWS services. Since all calls to AWS are API calls, no matter what interface the client uses, the CloudTrail service gives us the ability to gain complete insight into who performed what action over which resource and when.
CloudTrail collects this information in the AWS API backend and can output the collected information to a collection bucket that we designate. All data collected by CloudTrail is automatically encrypted, and we can additionally protect all the logs in the bucket by enabling the CloudTrail log file integrity validation. The CloudTrail log file integrity validation enables you to determine whether the log file has changed or has been altered since the time it was collected and initially stored, whether any log file was deleted...
