CloudTrail

• CloudTrail is an AWS service that helps you enable governance, compliance, and operational and risk auditing of your AWS account.

• Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail.

• For an ongoing record of activity and events in your AWS account, create a trail.

CloudTrail Data events

• Data events provide information about the resource operations performed on or in a resource.

• These are also known as data plane operations.

• Data events are often high-volume activities.

• CloudTrail data events are disabled by default.

CloudTrail Management events

• Management events provide information about management operations that are performed on resources in your AWS account.

• These are also known as control plane operations.

• CloudTrail records management events for the last 90 days free of charge, and are viewable in the Event History with the CloudTrail console.

CloudTrail Insights events

• Insights events capture unusual activity in your AWS account.

• If you have Insights events enabled, and CloudTrail detects unusual activity, Insights events are logged to a different folder or prefix in the destination S3 bucket for your trail.