Basic Information
| Field | Value |
|---|---|
| English | AWS CloudTrail |
| Full name | AWS CloudTrail |
| Chinese | 账户活动与 API 审计日志 |
| Japanese | AWS CloudTrail（API 操作履歴・監査ログ） |
| Exam frequency | ⭐⭐⭐⭐⭐ |
| Often confused with | Amazon CloudWatch / AWS Config |
One-line summary
Record API calls and account activity to show who did what, when, and from where.
Core capabilities and use cases
- Records activity initiated by the console, CLI, SDKs, and AWS services.
- Events include identity, time, source IP, Region, request parameters, and outcome.
- Event history provides recent management events; trails deliver events to S3 for long-term retention.
- Management events cover control-plane actions; data events cover resource-level activity such as S3 object access.
- CloudTrail Insights can detect unusual management-event calling patterns.
Exam focus and common pitfalls
- Enable data events to audit S3 GetObject/DeleteObject and similar resource-level operations.
- Use an organization trail for centralized multi-account auditing.
- CloudTrail is not primarily a CPU, latency, or application-performance monitor.
Key takeaway
Who, when, from where, and which API? Think CloudTrail.