AWS CloudTrail: Event History & Trails

CloudTrail records activity in the AWS control plane and beyond

AWS CloudTrail records activity in an AWS account as structured events. An event can describe an action performed through the AWS Management Console, AWS CLI, SDKs, AWS APIs or by another AWS service. Fields such as the event source, event name, identity information, time, Region, source address and referenced resources make CloudTrail the first place to answer governance questions such as who changed a resource, which API operation was called and from where the request originated.

CloudTrail defines four broad event types: management events, data events, network activity events and Insights events. Management events capture control-plane operations such as configuring security or creating resources. Data events describe often high-volume operations performed on or within supported resources. Network activity events provide visibility into certain denied API operations through VPC endpoints. Insights events identify unusual API activity patterns when the corresponding capability is enabled.

Event history is useful immediately, but it is not a durable audit archive

The CloudTrail Event history exists independently of trails and event data stores. It provides a searchable view of recent management events for the current account and Region without requiring you to create a trail first. AWS currently exposes the previous 90 days of management events in Event history. It does not provide the same view for data, Insights or network activity events, and it is not an organization-wide aggregation mechanism.

That distinction is important in incident response and exam scenarios. Event history is convenient for a recent control-plane investigation, but it is not a substitute for an ongoing retention design. If an organization needs a durable audit record, broader event types or centralized multi-account governance, it should configure a trail or appropriate CloudTrail Lake event data stores rather than relying on the rolling Event history window.

Trails deliver an ongoing record to storage and monitoring systems

A CloudTrail trail provides ongoing delivery of selected event activity to an Amazon S3 bucket. A multi-Region trail captures activity across enabled Regions and is AWS's recommended pattern for broad account auditing. A trail can also send events to CloudWatch Logs for operational monitoring, where metric filters and alarms can detect patterns such as selected authentication or configuration changes. Data events and other higher-volume categories must be deliberately selected and can add charges, so selectors should reflect the evidence the organization truly needs.

For centralized governance, CloudTrail can create organization trails that apply across accounts in AWS Organizations. This reduces the risk that every workload account implements audit logging differently and makes it easier to centralize logs in a designated account. Protecting the destination, limiting who can change trail configuration, validating log integrity where required, and monitoring trail health are part of the audit design—not merely checking that a trail object exists.

• Management events are enabled by default for trails and event data stores; data, network activity and Insights events are opt-in according to their documented configuration.
• Data events can be high volume, so advanced event selectors are useful for targeting the resources and operations that matter.
• A trail's S3 delivery supports long-term retention; CloudWatch Logs integration supports monitoring and alarms on event patterns.