Which statements are best practices working with AWS CloudTrail Select 2?
|
This section summarizes basic concepts related to CloudTrail. Show
Contents
What are CloudTrail events?An event in CloudTrail is the record of an activity in an AWS account. This activity can be an action taken by a user, role, or service that is monitorable by CloudTrail. CloudTrail events provide a history of both API and non-API account activity made through the AWS Management Console, AWS SDKs, command line tools, and other AWS services. There are three types of events that can be logged in CloudTrail: management events, data events, and CloudTrail Insights events. By default, trails log management events, but not data or Insights events. All event types use a CloudTrail JSON log format. What are management events?Management events provide information about management operations that are performed on resources in your AWS account. These are also known as control plane operations. Example management events include:
Management events can also include non-API events that occur in your account. For example, when a user signs in to your account, CloudTrail logs the ConsoleLogin event. For more information, see Non-API events captured by CloudTrail. For a list of management events that CloudTrail logs for AWS services, see CloudTrail supported services and integrations. What are data events?Data events provide information about the resource operations performed on or in a resource. These are also known as data plane operations. Data events are often high-volume activities. The following data types are recorded:
Data events are not logged by default when you create a trail. To record CloudTrail data events, you must explicitly add to a trail the supported resources or resource types for which you want to collect activity. For more information, see Creating a trail and Data events. Additional charges apply for logging data events. For CloudTrail pricing, see AWS CloudTrail Pricing. What are Insights events?CloudTrail Insights events capture unusual API call rate or error rate activity in your AWS account. If you have Insights events enabled, and CloudTrail detects unusual activity, Insights events are logged to a different folder or prefix in the destination S3 bucket for your trail. You can also see the type of insight and the incident time period when you view Insights events on the CloudTrail console. Insights events provide relevant information, such as the associated API, error code, incident time, and statistics, that help you understand and act on unusual activity. Unlike other types of events captured in a CloudTrail trail, Insights events are logged only when CloudTrail detects changes in your account's API usage or error rate logging that differ significantly from the account's typical usage patterns. Examples of activity that might generate Insights events include:
These examples are provided for illustration purposes only. Your results may vary depending on your use case. Insights events are disabled by default when you create a trail. To record CloudTrail Insights events, you must explicitly enable Insights event collection on a new or existing trail. For more information, see Creating a trail and Logging Insights events for trails. Additional charges apply for logging CloudTrail Insights events. For CloudTrail pricing, see AWS CloudTrail Pricing. What is CloudTrail event history?CloudTrail event history provides a viewable, searchable, and downloadable record of the past 90 days of CloudTrail events. You can use this history to gain visibility into actions taken in your AWS account in the AWS Management Console, AWS SDKs, command line tools, and other AWS services. You can customize your view of event history in the CloudTrail console by selecting which columns are displayed. For more information, see Viewing events with CloudTrail Event history. What are trails?A trail is a configuration that enables delivery of CloudTrail events to an Amazon S3 bucket, CloudWatch Logs, and CloudWatch Events. You can use a trail to filter the CloudTrail events you want delivered, encrypt your CloudTrail event log files with an AWS KMS key, and set up Amazon SNS notifications for log file delivery. For more information about how to create and manage a trail, see Creating a trail for your AWS account. What are organization trails?An organization trail is a configuration that enables delivery of CloudTrail events in the management account and all member accounts in an AWS Organizations organization to the same Amazon S3 bucket, CloudWatch Logs, and CloudWatch Events. Creating an organization trail helps you define a uniform event logging strategy for your organization. When you create an organization trail, a trail with the name that you give it will be created in every AWS account that belongs to your organization. Users with CloudTrail permissions in member accounts will be able to see this trail (including the trail ARN) when they log into the AWS CloudTrail console from their AWS accounts, or when they run AWS CLI commands such as describe-trails (although member accounts must use the ARN for the organization trail, and not the name, when using the AWS CLI). However, users in member accounts will not have sufficient permissions to delete the organization trail, turn logging on or off, change what types of events are logged, or otherwise alter the organization trail in any way. For more information about AWS Organizations, see Organizations Terminology and Concepts. For more information about creating and working with organization trails, see Creating a trail for an organization. How do you manage CloudTrail?CloudTrail consoleYou can use and manage the CloudTrail service with the AWS CloudTrail console. The console provides a user interface for performing many CloudTrail tasks such as:
Beginning on April 12, 2019, trails will be viewable only in the AWS Regions where they log events. If you create a trail that logs events in all AWS Regions, it will appear in the console in all AWS Regions. If you create a trail that only logs events in a single AWS Region, you can view and manage it only in that AWS Region. For more information about the AWS Management Console, see AWS Management Console. CloudTrail CLIThe AWS Command Line Interface is a unified tool that you can use to interact with CloudTrail from the command line. For more information, see the AWS Command Line Interface User Guide. For a complete list of CloudTrail CLI commands, see Available Commands. CloudTrail APIsIn addition to the console and the CLI, you can also use the CloudTrail RESTful APIs to program CloudTrail directly. For more information, see the AWS CloudTrail API Reference. AWS SDKsAs an alternative to using the CloudTrail API, you can use one of the AWS SDKs. Each SDK consists of libraries and sample code for various programming languages and platforms. The SDKs provide a convenient way to create programmatic access to CloudTrail. For example, you can use the SDKs to sign requests cryptographically, manage errors, and retry requests automatically. For more information, see the Tools for Amazon Web Services page. Why use tags for trails?A tag is a customer-defined key and optional value that can be assigned to AWS resources, such as CloudTrail trails, Amazon S3 buckets used to store CloudTrail log files, AWS Organizations organizations and organizational units, and many more. By adding the same tags to trails and to the Amazon S3 buckets you use to store log files for trails, you can make it easier to manage, search for, and filter these resources with AWS Resource Groups. You can implement tagging strategies to help you consistently, effectively, and easily find and manage your resources. For more information, see AWS Tagging Strategies. How do you control access to CloudTrail?AWS Identity and Access Management is a web service that enables Amazon Web Services (AWS) customers to manage users and user permissions. Use IAM to create individual users for anyone who needs access to AWS CloudTrail. Create an IAM user for yourself, give that IAM user administrative privileges, and use that IAM user for all of your work. By creating individual IAM users for people accessing your account, you can give each IAM user a unique set of security credentials. You can also grant different permissions to each IAM user. If necessary, you can change or revoke an IAM user’s permissions at any time. For more information, see Controlling user permissions for CloudTrail. How do you log management and data events?By default, trails log management events for your AWS account and don't include data events. You can choose to create or update trails to log data events. Only events that match your trail settings are delivered to your Amazon S3 bucket, and optionally to an Amazon CloudWatch Logs log group. If the event doesn't match the settings for a trail, the trail doesn't log the event. For more information, see Working with CloudTrail log files. How do you log CloudTrail Insights events?AWS CloudTrail Insights helps AWS users identify and respond to unusual volumes of API calls or errors logged on API calls by continuously analyzing CloudTrail management events. An Insights event is a record of unusual levels of write management API activity, or unusual levels of errors returned on management API activity. The details page of an Insights event shows the event as a graph of unusual activity, and shows the start and end times of the unusual activity, along with the baseline that is used to determine whether the activity is unusual. By default, trails don't log CloudTrail Insights events. In the console, you can choose to log Insights events when you create or update a trail. When you use the CloudTrail API, you can log Insights events by editing the settings of an existing trail with the PutInsightSelectors API. Additional charges apply for logging CloudTrail Insights events. For more information, see Logging Insights events for trails and AWS CloudTrail Pricing. How do you run complex queries on events logged by CloudTrail?CloudTrail Lake lets you run fine-grained SQL-based queries on your events. You do not need to have a trail configured in your account to use CloudTrail Lake. Event data stores are immutable collections of events based on criteria that you select by applying advanced event selectors. You can keep the event data in an event data store for up to seven years. You can save Lake queries for future use, and view results of queries for up to seven days. CloudTrail Lake can also store events from an organization in AWS Organizations in an event data store, or events from multiple regions and accounts. CloudTrail Lake is part of an auditing solution that helps you perform security investigations and troubleshooting. For more information, see Working with AWS CloudTrail Lake. How do you perform monitoring with CloudTrail?CloudWatch Logs, CloudWatch Events, and CloudTrailAmazon CloudWatch is a web service that collects and tracks metrics to monitor your Amazon Web Services (AWS) resources and the applications that you run on AWS. Amazon CloudWatch Logs is a feature of CloudWatch that you can use specifically to monitor log data. Integration with CloudWatch Logs enables CloudTrail to send events containing API activity in your AWS account to a CloudWatch Logs log group. CloudTrail events that are sent to CloudWatch Logs can trigger alarms according to the metric filters you define. You can optionally configure CloudWatch alarms to send notifications or make changes to the resources that you are monitoring based on log stream events that your metric filters extract. Using CloudWatch Logs, you can also track CloudTrail events alongside events from the operating system, applications, or other AWS services that are sent to CloudWatch Logs. For more information, see Monitoring CloudTrail Log Files with Amazon CloudWatch Logs. Amazon CloudWatch Events is an AWS service that delivers a near real-time stream of system events that describe changes in AWS resources. In CloudWatch Events, you can create rules that trigger on any event recorded by CloudTrail. For more information, see Creating a CloudWatch Events Rule That Triggers on an AWS API Call Using AWS CloudTrail. Insights events are integrated with CloudWatch. You can deliver events that you are subscribed to on your trail, including Insights events, to CloudWatch Events and CloudWatch Logs. To configure CloudWatch Events with the CloudWatch console or API, choose the AWS Insight via CloudTrail event type on the Create rule page in the CloudWatch console. Sending data that is logged by CloudTrail to CloudWatch Logs or CloudWatch Events requires that you have at least one trail. For more information about how to create a trail, see Creating a Trail. How does CloudTrail behave regionally and globally?A trail can be applied to all Regions or a single Region. As a best practice, create a trail that applies to all Regions in the AWS partition in which you are working. This is the default setting when you create a trail in the CloudTrail console. Turning on a trail means that you create a trail and start delivery of CloudTrail event log files to an Amazon S3 bucket. In the CloudTrail console, logging is turned on automatically when you create a trail. What are the advantages of applying a trail to all Regions?A trail that applies to all AWS Regions has the following advantages:
What happens when you apply a trail to all Regions?When you apply a trail to all AWS Regions, CloudTrail uses the trail that you create in a particular Region to create trails with identical configurations in all other Regions in your account. This has the following effects:
Multiple trails per RegionIf you have different but related user groups, such as developers, security personnel, and IT auditors, you can create multiple trails per Region. This allows each group to receive its own copy of the log files. CloudTrail supports five trails per Region. A trail that applies to all AWS Regions counts as one trail in every Region. The following example is a Region with five trails:
Trails appear in the AWS Region where they exist. Trails that log events in all AWS Regions appear in every Region. You can view a list of trails in an AWS Region in the Trails page of the CloudTrail console. For more information, see Updating a trail. For CloudTrail pricing, see AWS CloudTrail Pricing. AWS Security Token Service and CloudTrailAWS Security Token Service (AWS STS) is a service that has a global endpoint and also supports region-specific endpoints. An endpoint is a URL that is the entry point for web service requests. For example, https://cloudtrail.us-west-2.amazonaws.com is the US West (Oregon) regional entry point for the AWS CloudTrail service. Regional endpoints help reduce latency in your applications. When you use an AWS STS region-specific endpoint, the trail in that region delivers only the AWS STS events that occur in that region. For example, if you are using the endpoint sts.us-west-2.amazonaws.com, the trail in us-west-2 delivers only the AWS STS events that originate from us-west-2. For more information about AWS STS regional endpoints, see Activating and Deactivating AWS STS in an AWS Region in the IAM User Guide. For a complete list of AWS regional endpoints, see AWS Regions and Endpoints in the AWS General Reference. For details about events from the global AWS STS endpoint, see Global service events. Global service eventsAs of November 22, 2021, AWS CloudTrail will change how trails can be used to capture global service events. After the change, events created by CloudFront, IAM, and AWS STS will be recorded in the region in which they were created, the US East (N. Virginia) region, us-east-1. This makes CloudTrail's treatment of these services consistent with that of other AWS global services. To continue receiving global service events outside of US East (N. Virginia), be sure to convert single-region trails using global service events outside of US East (N. Virginia) into multi-region trails. Also update the region of your lookup-events API calls to view global service events. For more information about using the CLI to update or create trails for global service events and update lookup events, see Viewing CloudTrail events with the AWS CLI and Using update-trail. For most services, events are recorded in the region where the action occurred. For global services such as AWS Identity and Access Management (IAM), AWS STS, and Amazon CloudFront, events are delivered to any trail that includes global services. For most global services, events are logged as occurring in US East (N. Virginia) Region, but some global service events are logged as occurring in other regions, such as US East (Ohio) Region or US West (Oregon) Region. To avoid receiving duplicate global service events, remember the following:
Example:
When you create or update a trail with the AWS CLI, AWS SDKs, or CloudTrail API, you can specify whether to include or exclude global service events for trails. You cannot configure global service event logging from the CloudTrail console. How does CloudTrail relate to other AWS monitoring services?CloudTrail adds another dimension to the monitoring capabilities already offered by AWS. It does not change or replace logging features you might already be using, such as those for Amazon S3 or Amazon CloudFront subscriptions. Amazon CloudWatch focuses on performance monitoring and system health. CloudTrail focuses on API activity. Although CloudTrail does not report on system performance or health, you can use CloudTrail with CloudWatch alarms to notify you about activity that you might be interested in. Partner solutionsAWS partners with third-party specialists in logging and analysis to provide solutions that use CloudTrail output. For more information, visit the CloudTrail detail page at AWS CloudTrail. Which statements are best practices for working with AWS CloudTrail?CloudTrail detective security best practices. Create a trail.. Apply trails to all AWS Regions.. Enable CloudTrail log file integrity.. Integrate with Amazon CloudWatch Logs.. Log to a dedicated and centralized Amazon S3 bucket.. Use server-side encryption with AWS KMS managed keys.. Which tasks can you perform using AWS CloudTrail select two?AWS CloudTrail enables auditing, security monitoring, and operational troubleshooting. CloudTrail records user activity and API calls across AWS services as events.
What are key benefits of AWS CloudTrail select two?AWS CloudTrail enables auditing, security monitoring, and operational troubleshooting by tracking user activity and API usage. CloudTrail logs, continuously monitors, and retains account activity related to actions across your AWS infrastructure, giving you control over storage, analysis, and remediation actions.
Which services can you perform with the CloudTrail application in the AWS environment?You can use CloudTrail to view, search, download, archive, analyze, and respond to account activity across your AWS infrastructure. You can identify who or what took which action, what resources were acted upon, when the event occurred, and other details to help you analyze and respond to activity in your AWS account.
|
