description AWS CloudTrail Overview
While not a recovery tool itself, CloudTrail is the single most important component for *proving* compliance and understanding *why* a failure occurred. It records every API call made in your account. In a DR context, reviewing CloudTrail logs during a simulated failure helps pinpoint the exact service or permission that failed, allowing you to harden your recovery runbooks and prevent recurrence. It is the ultimate source of truth for governance.
help AWS CloudTrail FAQ
What does AWS CloudTrail record during a disaster recovery test?
CloudTrail records AWS account activity such as API calls made through the console, CLI, SDKs, and AWS services. In a DR drill, it can show who changed an EC2 setting, modified an IAM role, or triggered an automation step.
Can CloudTrail prove who deleted or changed an AWS resource?
Often, yes, if the action is a supported management or data event and logging was enabled for the right account and region. A CloudTrail event usually includes fields such as eventName, eventTime, userIdentity, sourceIPAddress, and requestParameters.
How long can you see recent CloudTrail events without building a trail?
CloudTrail Event history provides a recent view of management events for the last 90 days. For longer retention, teams usually create a trail that delivers logs to Amazon S3 or use CloudTrail Lake for queryable event storage.
How is CloudTrail different from AWS Elastic Disaster Recovery?
AWS Elastic Disaster Recovery helps replicate and recover servers, while CloudTrail explains what happened in the AWS control plane. In an incident, CloudTrail is the audit trail, not the recovery engine.
explore Explore More
Similar to AWS CloudTrail
See all arrow_forward
Reviews & Comments
Write a Review
Be the first to review
Share your thoughts with the community and help others make better decisions.
