Introduction to AWS CloudTrail

AWS CloudTrail records events in your AWS account, providing a detailed documentary of user actions, roles, or AWS services. Each event captured by CloudTrail provides comprehensive information that can be used for security analysis, compliance auditing, and operational troubleshooting.

Every API call you make to your AWS account, whether via the Management Console, CLI, or using the SDKs, is recorded in AWS CloudTrail. This enables you to identify what action has taken place in your account, by whom, and when, facilitating an extensive audit trail. By default, management events are logged and retrained for 90 days. However, you can create a CloudTrail trail to log events to an Amazon S3 bucket for an indefinite retention period. You can also send the event captured to CloudWatch Logs and Amazon EventBridge.

A CloudTrail trail can be created for a single region or a multi-region. Multi-region trails capture events across all regions and are a recommended...