AWS CloudTrail

-

 AWS CloudTrail


AWS CloudTrail - 

  • AWS CloudTrail is a web service that records activity made on your account 
  • A cloudtrail trail can be treated which delivers log files to an S3 bucket
  • CloutTrail is about logging and saves a history of API calls for your AWS account
  • Provides governance, compliance, and operational and auditing of your AWS account 
  • Enabled by default
  • Records the API calls made within the AWS account 
  • Event Retention- 90days
  • CloudTrail logs up to the last 90 days can be analyzed in Cloudtrail console. Older logs should be present in S3 and can be analyzed using athena
  • modification to logs files can be Detected by enabling Log File Validation on the logging bucket 


Event Types - 

Managment Events - 
  • Events of operation that modifies AWS resources like creating IAM user, deleting subnet 
  • Enabled by default 
  • Can saperate read events from write events 
Data Events - 
  • Events of operation that modify data like Lamda function execution, S3 object level activity
  • Disabled by default
Insight Events - 
  • Enable Cloudtrail insight to detect unusual activity in your account like inacccurate resource provisioning,hitting service limits, burst of AWS IAm actions, gaps in periodic maintainance activity 

Encryption - 
  • Cloudtrail logs are encrypted by default using SSE-S3
  • A single KMS key can be used to encypt log files for trails applied to all regions 



CloudTrail vs CloudWatch - 



Comments

Post a Comment

Popular posts from this blog

AWS Instance Store

-
Image
 AWS Instance Store  AWS Instance Store -  Hardware storage directly attached to EC2 instance amd cannot be detached and attached to another instance  Highest IOPS for any available storage Ephemiral Storage (Loses data when instance is terminated, stopped or hibernated) Good to buffer/cache/scratch data/temporary content  AMI created from an instance does not its instance store volume preserved  You can specify the instance store volumes to an instance when you launch the instance. You can't attach instance store volumes to an instance after you’ve launched it. Raid -  Raid 0  Improve performance of a storage volume by distributing reads and write in a stripes across attached volumes  If you add a storage volume you get the straight addition of throughput and iops For high performance applications Raid 1   Improve data availability by mirroring in multiple volumes For critical applications
Read more

AWS Identity and Access Management

-
Image
  IAM Introduction to IAM -  AWS identity and management is a web service that helps you to securely control access to AWS resources You use IAM to control who is authenticated and authorized to use resources IAM allows you to create and manage AWS users and groups , and use permissions to allow or deny their access to AWS resources IAM is a fundamental part of AWS security, as it allows you to implement the principle of least privilege , ensuring that users and applications have only the permissions they need to perform their tasks IAM also provides features such as multi-factor authentication (MFA) , password policies, and access keys to enhance the security of your AWS environment Features of IAM -  IAM User  -   IAM allows you to create and manage users in your AWS account Each IAM user has a unique name and security credentials, which are used to authenticate and authorize their access to AWS resources IAM users have security credentials that are us...
Read more

Elastic Block Storage (EBS)

-
Image
 Elastic Block Storage (EBS) Elastic Block Storage (EBS) -  AWS Elastic Block Storage is a web service that provides block level storage volumes for use with amazon EC2 instances Amazon EBS volumes are highly available and reliable storage volumes that can be attached to any running instance and used like hard drive Amazon EBS allows you to create storage volumes and attach them to EC2 instances   It is used for various databses (both relational and non relational) as well as a wide range of application such as software testing and development  EBS provides a high performance option for many use cases it is directly attached to the instance Features of EBS  -  Amazon Elastic Block Storage  Region and availability zones are multiple physical location for your resources such as instances and EBS volumes Using security groups, you can specify the protocols, ports and source IP ranges that can reach your instances Elastic IP addresses are static IPv4 ...
Read more