What is AWS CloudTrail? A plain-English explainer
AWS CloudTrail is an AWS service that records and audits API calls and account activity — a log of who did what, when, and from where, across an AWS account. Almost every action taken in AWS, whether from the console, the command line, or an application calling the AWS API directly, is itself an API call, and CloudTrail captures that call as an event: which identity made it, what action it requested, what resource it affected, and when. It exists so that “who changed this” or “who deleted that” has an answer, rather than being a question nobody can settle after the fact. Here is what CloudTrail actually does, how it differs from a service it is frequently confused with, and how it supports security work.
What CloudTrail actually does
CloudTrail continuously records the API activity happening in an AWS account and turns it into a searchable event history: each entry captures the identity that made the call (a user, a role, or another AWS service), the action requested, the resource involved, the source IP, and the timestamp. This applies whether the call came from a person clicking around the console, a script using the AWS CLI, or an application using the AWS SDK — CloudTrail does not distinguish by interface, only by the underlying API call.
That event history is what makes questions like “who deleted this S3 bucket” or “who changed this security group last Tuesday” answerable after the fact, rather than a matter of guesswork.
CloudTrail versus CloudWatch: actions versus health
This is the distinction most worth getting right, because the two names sound alike and the services do genuinely different jobs. CloudTrail is an audit trail of actions — it answers who did what, and when. Amazon CloudWatch is a monitoring service — it answers how healthy and performant your resources are, through metrics, logs and alarms about things like CPU usage, error rates and application logs. Our what-is-amazon-cloudwatch explainer covers that side directly, and our what-is-observability explainer covers the broader idea both services sit inside.
A simple way to keep them apart: if the question is “is this system running well”, that is CloudWatch; if the question is “who made this change”, that is CloudTrail.
How CloudTrail supports security
Because CloudTrail records every API call, it becomes a central piece of evidence when investigating a security incident — establishing exactly which identity did what, in what order, is often the difference between a fast, confident response and a guess. It is also a foundation for governance and compliance, since many standards require an auditable record of account activity, and for day-to-day security hygiene, such as noticing when a highly privileged action was taken by an identity that should not normally take it.
CloudTrail also works alongside other AWS security services rather than replacing them. Amazon GuardDuty, for example, is a threat-detection service that analyses signals — including CloudTrail activity — to flag anomalous or malicious behaviour automatically, rather than requiring someone to comb through the event history by hand. Our what-is-amazon-guardduty explainer covers that side of the pairing.
Common uses
CloudTrail tends to get reached for whenever the question is about actions and accountability rather than performance:
- Security investigations — reconstructing exactly what happened, and by whom, after a suspicious event.
- Compliance and audit — providing the auditable activity record many regulatory and internal standards require.
- Operational troubleshooting — working out which change caused a resource to stop behaving as expected.
- Governance — reviewing account activity to catch risky or unexpected actions before they become incidents.
How pricing works, in one line
CloudTrail follows the same pay-for-use model as most of AWS: a baseline level of account activity logging is provided, with additional cost tied to extra trails, longer retention, or higher-volume event logging beyond that baseline. Exact allowances and rates change over time, so AWS’s own CloudTrail pricing page is the accurate source rather than a figure repeated here.
Where CloudTrail appears in certification study
CloudTrail is core material on AWS Certified Security – Specialty, which expects a solid grasp of using it for investigation, governance and integration with services like GuardDuty. It also appears on AWS Certified CloudOps Engineer – Associate, with a more operational focus on setting up trails and using them for troubleshooting, and it is worth knowing conceptually for AWS Certified Solutions Architect – Associate as part of designing accounts with proper auditability. Our /revision study library covers that depth lesson by lesson.
Original practice questions, timed mock exams and revision notes. No card, nothing to pay.