In 2018, Amazon launched a new concept called AmazonGo, which introduced society to cashier-less stores and promised to eliminate the long check-out queues that you find in busy retail spaces. A person needs an active Amazon account, along with a modern smartphone, and they can walk into the store, pick out any items, and walk out. CloudTrail derives from this idea, which serves the same purpose as AmazonGo – to track user, role, or an AWS service activity on the Amazon platform. Let's take a deeper dive into CloudTrail and see what it can do.

What Is CloudTrail?

CloudTrail is a service offered by Amazon Web Services (AWS). It enables your Amazon Web Services account's governance, compliance, and operational auditing. CloudTrail works by recording API calls and sending them to a storage location. In essence, every action taken by a user, role, or an AWS service in the AWS account will be logged and assigned a timestamp with a description of the action taken. This logged action is an event that users can send to an S3 bucket for storage. 

How Are CloudTrail Events Used?

Users can use CloudTrail events for a variety of purposes, such as:

• Observability of the platform,
• Regulatory compliance reporting, 
• Gaining insight through log correlation,
• Security. 

CloudTrail events add visibility and increase the ability to audit your environment, making them a critical piece to add to your monitoring strategy. A lack of proper visibility into user access within the environment can lead to severe problems on many fronts. It dramatically increases the time to detection when a breach occurs. In addition to possible security threats, a lack of CloudTrail logging could also lead to lost opportunities since the analysis of insight events can lead to new improvements.

Remember that an observability platform is only as good as the underlying data. It should have a diverse set of data sources to represent the actual health of the overall system. CloudTrail events represent the root source of changes within the environment, and they can help tell the story that your observability solution aims to convey.

Understanding Different Types of CloudTrail Events

There are three primary types of CloudTrail events within the AWS console. 

Management Events

These events provide information about management operations performed on resources within the AWS account. They represent security group changes, IAM role permission adjustments, and modifications to the Virtual Private Cloud (VPC). 

Data Events

Data events are entries for data request operations which include standard API commands and happen on the AWS data plane resource. These events are usually high volume and high velocity; consequently, they must be explicitly configured for collection when creating a trail. 

Insight Events

Insight events provide quick and insightful information with fast time to value and minimal configuration by identifying and logging unusual API call rate or error rate activity associated with the AWS account. As with data events, users must enable insight event collection on a new or existing trail. 

Managing CloudTrail Events

CloudTrail events are only one piece of the puzzle, and they are effectively useless without a platform that can index the data and present it in a consumable way. The Mezmo (formerly known as LogDNA) platform is a perfect fit since it provides schema and an on-the-fly setup. It also allows you to ask questions about your user activity in AWS without having a defined schema built upfront. These questions can get complex, and the answers may necessitate CloudTrail events correlated from different data sources to provide insights that might have been impossible to see when looking at the events individually. In addition to data correlation, Mezmo has the capability of setting up alerts that notify you in near real-time so that you can leverage those insights. 

‍Conclusion

Amazon CloudTrail has three types of events that help administrators get a holistic view of user activity on their AWS platform and streamline operations thanks to the increased visibility and auditing they provide. These CloudTrail events are in time-series format and should be actively used and monitored on a log management platform that can offer fast, actionable insights. The benefits of leveraging these insights include reduced costs, fewer incidents, and an increased ability to detect security threats within your AWS environment. So, if you're not currently monitoring and leveraging insights from your CloudTrail logs, give it a shot. You will see significant returns on your investment immediately! 

‍