L4. CloudTrail: Management vs Data Events & Log Integrity

Management Events vs Data Events

CloudTrail records the API calls made against your account. Every call falls into one of two categories, and knowing which is which is the single most exam-tested fact about CloudTrail. Management events are control-plane operations: creating a bucket, launching an instance, modifying an IAM policy. Actions like CreateBucket and RunInstances fall here. Management events are logged by default and are visible for free in the 90-day Event History, with no trail required. Data events are object-level, data-plane operations: an S3 GetObject or PutObject call, a Lambda function Invoke. These are NOT logged by default. You must explicitly enable them, per resource, on a trail. Data events are far higher-volume than management events, so they also carry a higher cost once enabled.

Spotting Anomalies Automatically

CloudTrail Insights continuously baselines normal API activity and automatically flags unusual patterns, such as a spike in call volume or an unusual jump in error rates, without you writing custom detection logic. It surfaces the kind of anomaly that would otherwise take a human analyst hours to notice in a busy account.

Centralizing Logs Across an Organization

An organization trail, created from the AWS Organizations management account, automatically aggregates CloudTrail logs from every current and future member account into one central S3 bucket. This bucket is typically locked down and accessible only to a small security team, giving you a single, consistent audit trail across an entire multi-account environment instead of stitching together per-account trails yourself.

Proving Logs Have Not Been Tampered With

CloudTrail's log file integrity validation lets you cryptographically prove that a delivered log file has not been altered or deleted after the fact. Each log file is hashed with SHA-256, and the hashes are chained together into a digest file that is itself digitally signed using the trail's KMS key. To verify a log, you recompute its hash and compare it against the signed digest chain. If anything changed, even a single character, the comparison fails. This matters enormously for forensic investigations, where you may need to demonstrate in court or to an auditor that evidence was not manipulated.

Querying Logs Without Building Infrastructure

CloudTrail Lake lets you run standard SQL queries directly against your event data, without standing up your own Athena tables or S3 pipeline. It is the fastest path to ad hoc historical investigation when you do not want to manage the underlying storage and query infrastructure yourself. Exam tip: The recommended CloudTrail baseline is a multi-region trail, SSE-KMS encryption on the log bucket, and a bucket policy that denies delete permissions on the log-archive bucket, even to the security team's own day-to-day role. Logs that anyone can delete are not a reliable audit trail.