Audit Logging

AWS CloudTrail records API calls across your AWS account. Every action taken through the console, CLI, SDK, or CloudFormation generates a CloudTrail event. This provides an audit trail for security analysis, compliance, and operational troubleshooting.

Management events capture control plane operations: instance creation, IAM policy changes, S3 bucket modifications, and security group updates. Enable management events in all regions to capture activity even when you don't expect it. Management events are enabled by default and are free.

Data events capture data plane operations: S3 object-level operations (Get, Put, Delete), Lambda function invocations, and DynamoDB item operations. Data events are high-volume and cost money ($0.10 per 100,000 events). Enable selectively for specific S3 buckets or Lambda functions you need to audit.

CloudTrail Insights detects unusual API activity patterns. Insights analyzes your CloudTrail history and alerts when API call rates or error rates deviate significantly from normal. For example, a sudden spike in ec2:RunInstances calls from an unusual IP address indicates potential unauthorized resource creation.

CloudTrail Lake stores and analyzes CloudTrail events using SQL queries. Events are stored in immutable, tamper-proof S3 buckets. Query events with Athena or CloudTrail Lake's built-in query editor. Find all API calls from a specific user, all failed authentication attempts, or all S3 object deletions in a time range.

Log file integrity validation uses SHA-256 hashing and digitally signed files. Enable log file integrity validation to detect if CloudTrail logs have been tampered with. This is required for PCI DSS and many compliance frameworks. The digest files are delivered to S3 alongside the log files.

Organization trail creates a single trail that captures events from all member accounts. The management account configures the trail; events from all accounts are delivered to a central S3 bucket. This provides centralized auditing without individual account configuration.

Example: A security team enables CloudTrail in all regions with management events, S3 data events for the compliance bucket, and Insights. They create an organization trail aggregating all accounts. They use CloudTrail Lake to query for IAM policy changes from the last 24 hours and detect unauthorized access attempts.

AWS Config records the configuration of AWS resources over time. It captures what resources exist, their attributes, and how they changed. This creates a configuration history for compliance auditing and change tracking.

Config rules evaluate whether resources comply with desired configurations. Managed rules cover common compliance checks: encrypted-volumes (EBS encryption enabled), s3-bucket-public-read-prohibited (no public S3 access), iam-password-policy (password requirements met), and vpc-flow-logs-enabled (VPC logging active). Each rule evaluates resources and reports compliant or non-compliant.

Custom Config rules use Lambda functions to evaluate resources against custom logic. A custom rule might check: all S3 buckets have specific tags, all EC2 instances use approved AMIs, or all RDS instances are in specific regions. Custom rules evaluate on a schedule (every hour, every 6 hours) or when a configuration change occurs.

Conformance packs group multiple Config rules into a single compliance package. AWS provides pre-built conformance packs for common frameworks: Operational Best Practices for Security Hub, HIPAA, PCI DSS, and NIST 800-53. Deploy a conformance pack to automatically create and manage all associated rules.

Remediation automatically fixes non-compliant resources. When a Config rule finds a violation, a remediation action (Systems Manager Automation document or Lambda function) corrects the issue. Example: if an S3 bucket is made public, remediation immediately makes it private. Remediation can be automatic or require manual approval.

Config aggregator collects configuration data from multiple accounts and regions into a single dashboard. View compliance status across your entire organization. Aggregators are essential for enterprise compliance reporting.

Change history shows what changed, when, and who changed it. If a security group was modified to allow 0.0.0.0/0 on port 22, Config shows the exact change, the timestamp, and the IAM user who made it. This is invaluable for incident response and compliance audits.

Example: Deploy the PCI DSS conformance pack across all accounts. Config rules check encryption, access controls, and logging. Non-compliant resources trigger SNS notifications. Auto-remediation fixes S3 bucket policies and security groups. Monthly compliance reports show 98% compliance with 3 resources pending remediation.

Amazon Macie is a fully managed service that discovers, classifies, and protects sensitive data in S3. It uses machine learning and pattern matching to find PII, PHI, financial data, and intellectual property.

How Macie works: Enable Macie for your account. Create a discovery job targeting specific S3 buckets or the entire account. Macie scans objects, identifies sensitive data types (names, addresses, social security numbers, credit card numbers, medical records), and generates findings with severity levels.

Macie findings include: what data was found (PII type, sample data), where it was found (bucket, object key), severity (high, medium, low), and classification details. A finding showing credit card numbers in a public S3 bucket is high severity. Social security numbers in a private bucket might be medium severity.

Macie sensitive data categories: Financial (credit card numbers, bank account numbers), personal (names, addresses, phone numbers, email addresses), credentials (API keys, private keys), and health (medical record numbers, insurance IDs). Macie also detects custom data patterns using regular expressions.

Macie job schedules: Run discovery jobs on a schedule (daily, weekly) to continuously monitor for sensitive data. Jobs scan objects and compare against known patterns. New objects are scanned automatically. Historical objects are scanned on the schedule.

Macie integration with S3: Macie works with S3 bucket policies and access controls. If Macie finds sensitive data in a public bucket, the finding includes guidance on making the bucket private. Macie integrates with S3 Block Public Access to prevent public exposure.

Macie classification jobs can be triggered by S3 events. When a new object is uploaded, Macie automatically classifies it. This provides real-time detection of sensitive data uploads.

Example: A healthcare company enables Macie across all S3 buckets. Macie discovers that a development bucket contains a CSV file with 10,000 patient records including social security numbers and medical diagnoses. The finding is high severity. The team immediately moves the file to an encrypted bucket, restricts access, and implements controls to prevent future uploads of PHI to non-compliant buckets.