# AWS CloudTrail

> AWS CloudTrail records the API calls and account activity in AWS, so you can audit who did what, when and from where, and investigate security incidents.

- Source: https://www.itwonderlab.com/aws-cloudtrail/
- Published: 2026-10-05
- Updated: 2026-10-05
- Author: Javier Ruiz Jiménez (https://www.javierruizjimenez.com/)
- Site: IT Wonder Lab (https://www.itwonderlab.com/)

---

**AWS CloudTrail** records the activity in an AWS account: every call to the AWS API, made from the console, the CLI, an SDK, [Terraform](https://www.itwonderlab.com/tutorials/terraform/) or another AWS service, is an **event** with the identity, the time, the source IP address, the action, the resources and the result.

### Key concepts

- **Event history**: the last 90 days of management events, searchable in the console at no cost.
- **Trail**: delivers the events to an [S3](https://www.itwonderlab.com/aws-s3/) bucket (optionally also to [CloudWatch](https://www.itwonderlab.com/aws-cloudwatch/) Logs) for long-term storage. A trail can cover all the Regions and, with [AWS Organizations](https://www.itwonderlab.com/aws-organizations/), all the accounts.
- **Event types**: *management events* (control plane: creating an instance, changing a [security group](https://www.itwonderlab.com/aws-security-groups/)), *data events* (S3 object or Lambda invocation level, off by default, they have a cost) and *Insights events* (unusual activity).
- **CloudTrail Lake**: stores events in a queryable data store, with SQL.
- **Log file validation** detects changes in the delivered files; encrypt them with [KMS](https://www.itwonderlab.com/aws-kms/) and protect the bucket from deletion.
- Typical uses: security analysis (who deleted that resource?), compliance audits, detecting changes made outside of Terraform (drift) and alarms on sensitive events such as root user logins.

### Pricing

Management events: one copy in the event history and the first trail are free of charge; additional copies, data events, Insights and Lake have a cost. See the [CloudTrail pricing](https://aws.amazon.com/cloudtrail/pricing/).

### With Terraform

The resources are `aws_cloudtrail`, `aws_cloudtrail_event_data_store` and the bucket with its policy.

See also: [AWS IAM](https://www.itwonderlab.com/aws-iam/).