AWS CloudTrail is described as an AWS service that helps you enable governance, compliance, and operational and risk auditing of your AWS account (https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html) and is basically advertised as the central logging source for API activity in an AWS account. CloudTrail is an always-on service in some sense, in that it logs read/write API operations to an immutable archive of the last 90 days of logs, known as the CloudTrail Event history. We will get more into Event history in the Reconnaissance section of this chapter.
In this chapter, we will take a look at CloudTrail and the features that it provides us with as diligent AWS users. We will also look at it from the pentester's point of view, covering how to audit CloudTrail best practices in a target account, but also how to perform...
