What is AWS CloudTrail and how do you ensure its security?

AWS CloudTrail records API calls and user activity across your AWS account, providing audit trails for compliance and security analysis.

Key Features:

• API call logging: Who, what, when, where for all AWS API calls
• Event history: 90 days of events in console (free)
• Custom trails: Long-term storage in S3 buckets
• Real-time delivery: CloudWatch Logs integration
• Multi-region: Capture events across all regions

Security Best Practices:

1. Enable for all regions: Capture global service events
2. Separate S3 bucket: Dedicated bucket with restricted access
3. Log file validation: Detect tampering with digest files
4. Encryption: S3 bucket encryption and KMS encryption
5. MFA delete: Require MFA for log deletion
6. Cross-account logging: Central security account for logs

Example CloudTrail Configuration:

{
  "Trail": {
    "Name": "SecurityAuditTrail",
    "S3BucketName": "company-security-logs",
    "IncludeGlobalServiceEvents": true,
    "IsMultiRegionTrail": true,
    "EnableLogFileValidation": true,
    "KMSKeyId": "arn:aws:kms:region:account:key/key-id"
  }
}