aws-cloudtrail

Look up recent events by username

$ aws cloudtrail lookup-events --lookup-attributes AttributeKey=Username,AttributeValue=[user@example.com]

$ aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=[RunInstances]

$ aws cloudtrail lookup-events --start-time [2024-01-01T00:00:00Z] --end-time [2024-01-02T00:00:00Z]

$ aws cloudtrail create-trail --name [my-trail] --s3-bucket-name [my-bucket] --is-multi-region-trail

$ aws cloudtrail start-logging --name [my-trail]

$ aws cloudtrail describe-trails

$ aws cloudtrail get-trail-status --name [my-trail]

aws cloudtrail command [options]

aws cloudtrail manages AWS CloudTrail, which logs API activity and events across AWS services for auditing, compliance, and security analysis.
lookup-events searches management events from the last 90 days without needing a trail configured. It's rate-limited to 2 requests per second per region.
Trails deliver logs to S3 buckets for long-term storage. Multi-region trails capture activity from all regions. Organization trails log events for all accounts in AWS Organizations.
Event selectors filter which events to log (management events, data events for S3/Lambda, or Insights events for anomaly detection).
Logs include who made the request, services used, actions performed, parameters, and response elements.

lookup-events

Search management events from the last 90 days

Create a new trail for logging API activity

List trails and their configuration

Get logging status of a trail

Begin logging events to a trail

Pause logging events to a trail

Modify trail configuration

Remove a trail (logs remain in S3)

Configure which events to log

Enable CloudTrail Insights

Trail name or ARN

S3 bucket for log storage

Log events from all regions

Log events for all accounts in organization

KMS key for log encryption

Filter events (AttributeKey=Type,AttributeValue=Value)

Start of time range for lookup

End of time range for lookup

EventId - Unique event identifier
EventName - API action (RunInstances, CreateBucket)
Username - IAM user or role name
ResourceType - AWS resource type
ResourceName - Resource identifier
EventSource - Service (ec2.amazonaws.com)
AccessKeyId - Access key used

lookup-events only searches the last 90 days; use Athena on S3 logs for older events. Rate limited to 2 requests/second. Only one lookup attribute per query. Trail creation requires S3 bucket and bucket policy configuration. Log delivery has a delay of several minutes.

AWS CloudTrail launched in November 2013 as AWS's audit logging service. It became a critical component for security, compliance, and governance. CloudTrail Insights for anomaly detection was added in 2019. CloudTrail Lake for SQL-based event querying launched in 2022.

aws(1), aws-s3(1), aws-athena(1), aws-config(1)