Reviewing Comprehensive Traceability of Users and Services

Apart from all the measures mentioned in the previous section and other measures that you can take to secure your AWS environment and resources, it is also paramount to keep track of all the activities that take place within your AWS environment. This is where AWS CloudTrail plays a key role. CloudTrail provides traceability of all the actions (API calls) taken in your AWS environment. It essentially logs all the events related to your resources in a log stored on S3. It also natively integrates with AWS Organizations, which allows you to manage a central trail of all events across your entire organization. Following the best practices from the Security Reference Architecture (see the Further Reading section of this chapter), you are encouraged to keep a central trail of all the events in your organization in a separate Log Archive account that can be used for security or auditing purposes. Additional logs should also be stored...