Certablo
Sign inCreate account
← Knowledge Base
Security & Identitycomparison

Security Audit Logging: CloudTrail, Config & CloudWatch

Three evidence planes that are often confused: CloudTrail for API activity, AWS Config for resource configuration history and compliance, and CloudWatch for operational metrics, logs and alarms—plus cryptographic CloudTrail log validation.

CLF-C02AIF-C01SAA-C03

Visual overview

DEFENSE IN DEPTHIdentity, data, network, detection, and audit controls protect different boundaries
IDENTITYAuthenticate + authorizePrincipals · policies · temporary credentials
DATAEncrypt + protect secretsKeys · certificates · application secrets
DETECT & AUDITFind threats + retain evidenceFindings · API history · configuration state
No single security service replaces the others. Strong AWS security combines preventive, detective, and evidence-producing controls around the workload.
AWS SERVICE MAPThree security evidence planes

CloudTrail records API activity, Config records resource state, and CloudWatch turns logs and metrics into operational visibility and alarms.

CloudTrailAPI activity and audit trail
AWS ConfigConfiguration history and compliance
CloudWatchLogs, metrics and alarms
EXAM-RELEVANT MECHANICS

Technical reference

Security evidence has both semantic scope—what was recorded—and integrity scope—whether the record can be trusted after delivery.

Recent API viewEvent history

CloudTrail provides a searchable per-Region history of recent management events; current retention is documented by AWS and can change.

Control planeManagement events

Record operations performed on AWS resources and services at the management/control plane.

Data planeData events

Record supported high-volume resource operations and require explicit selection in trails or event data stores.

Configuration evidenceConfigurationItem / Config rule

AWS Config records supported resource state over time and evaluates state against desired rule logic.

Integrity hashSHA-256

CloudTrail log file integrity validation hashes delivered log files and links them through digest metadata.

Digest signatureSHA-256 with RSA

CloudTrail signs digest files so the validation process can verify that digest evidence is authentic and unchanged.

Service limits and capabilities can change. Values shown here reflect the current AWS documentation; use the linked official sources below as the source of truth.

Start with the question your evidence must answer

AWS CloudTrail records activity around AWS API and control-plane interactions: who or what made a request, which API operation was called, when and where it happened, and request/response context according to the event type. AWS Config records supported resource configuration state and relationships over time and evaluates those configurations against Config rules. Amazon CloudWatch collects operational metrics and logs and can trigger alarms or downstream actions based on monitored conditions.

These services overlap in security operations but are not substitutes. To investigate who changed a security group, begin with CloudTrail API activity. To determine how the security group's recorded configuration changed and whether it was compliant with a desired rule, Config is the closer fit. To alarm when an application metric crosses a threshold or a log pattern appears, CloudWatch is the operational monitoring service. Mature incident response often correlates all three.

CloudTrail event classes and retention paths matter

CloudTrail Event history is available by default and provides a searchable record of recent management events in each Region. A trail is the durable delivery mechanism used to send selected CloudTrail events to an S3 bucket, with options for organization-wide logging and CloudWatch Logs integration. CloudTrail Lake provides event data stores and SQL-query capabilities for broader investigation and longer analytical retention according to its configuration.

Management events capture control-plane operations such as creating or changing resources. Data events represent high-volume resource-level operations such as supported S3 object or Lambda invocation activity and are not logged by trails or event data stores by default merely because management events are present. Selecting event categories therefore affects both forensic coverage and cost. A security design should explicitly name the operations it needs to reconstruct instead of assuming 'CloudTrail enabled' captures every data-plane request.

Audit evidence should be durable and tamper-evident

CloudTrail log file integrity validation can deliver digest files that allow an auditor to determine whether delivered log files were modified or deleted after delivery. AWS documents SHA-256 hashing and SHA-256 with RSA digital signatures as the cryptographic basis for this validation chain. The AWS CLI validate-logs workflow verifies digest signatures and referenced log hashes. This is stronger evidence than merely checking that a file exists in a bucket.

Storage architecture still matters. Centralized security accounts, restrictive S3 bucket policies, versioning or retention controls where appropriate, and KMS encryption can reduce the chance that a workload administrator can erase its own audit evidence. Config history complements that trail by showing resource-state changes, while CloudWatch alarms can surface suspicious operational conditions quickly. Prevention, detection, and evidence should be intentionally separated so a failure of one control does not destroy the others.

Key takeaways

  1. 01

    CloudTrail records AWS API activity; Config records resource configuration/compliance; CloudWatch handles operational observability and alarms.

  2. 02

    CloudTrail Event history covers recent management events and is not equivalent to a deliberately configured multi-Region or organization trail.

  3. 03

    Data events are a distinct, often high-volume event category and require explicit logging configuration for trails/event data stores.

  4. 04

    CloudTrail log integrity validation uses digest files and cryptographic hashes/signatures to detect modification or deletion after delivery.

  5. 05

    Centralized, access-controlled log storage reduces the risk that a compromised workload account can destroy its own evidence.

Official AWS sources

Use these primary AWS resources for the source material behind this article and for deeper reference.