CloudTrail

AWS CloudTrail records the API calls made in an account — who did what, to which resource, from where and when. It is the record consulted after a security incident, during an audit, or whenever someone needs to know how a resource came to be in its current state.

CloudTrail covers the three ways to hold that record: event history, trails and CloudTrail Lake event data stores. It also covers the event types they capture and how long delivery takes. The page ends with the settings that make a trail defensible — which matters, because a trail that can be switched off or edited by the people it records proves very little.

CloudTrail records what happened. To be alerted as it happens, CloudTrail events are usually routed into CloudWatch or Amazon EventBridge.