CloudTrail

• Records all API calls made in your AWS account. Enabled by default.
• Stores for 90 days in CloudTrail. For longer retention: send to S3, query with Athena.
• Event types:
  • Management Events — operations on resources (CreateVPC, AttachRolePolicy). Logged by default.
  • Data Events — high-volume S3 object-level (GetObject, PutObject) and Lambda invocations. NOT logged by default.
  • Insights Events — detect unusual activity (resource provisioning bursts, IAM action spikes).
• CloudTrail Insights — analyzes normal management events to baseline, then detects anomalies.
• If a resource is deleted → investigate CloudTrail first.

References

• AWS CloudTrail (User Guide)
• CloudTrail Lake