CloudTrail

CloudWatch is great for monitoring our systems, but how do we get logs for the AWS account itself? Think about this:

• Our CloudWatch agent is happily writing logs to CloudWatch, but what if they're being rejected by the API?
• What if the intern we fired last month changed our VPC settings? How would we know what they did?

CloudTrail is the answer. It logs the AWS API calls that we make.

With CloudTrail, you can see what folks have been doing on your AWS account. Each event includes information like:

• Who made the API call (username)
• What API call was made (e.g., DescribeAlarms, CreateInstance)
• When it occurred (timestamp)
• Whether it was a read or a write operation
• What resources were affected

For example, you might see that user vvega ran the API call DescribeAlarms at a specific time. This level of detail is critical to troubleshooting things on AWS. It tells you for certain what happened and when, regardless of the health of your monitoring systems.

There's Organization trails, which lets us combine multiple AWS accounts into a single trail and see what users are doing across all of them.