CloudTrail

AWS CloudTrail records who did what in your AWS accounts. An API call — from the console, the CLI, an SDK, or another AWS service — is captured as an event with the calling identity, source IP, parameters, and result. It is the system of record for security investigation, compliance evidence, and answering "what changed?"

What lands in that record is set by configuration, not assumed. Trails and event data stores log management events by default; data events, network activity events, and Insights events are captured only where you configure selectors for them. Read a trail's selectors before you treat its history as complete.

With AWS CloudTrail, you can:

• Look up recent activity: Search the last 90 days of management events by user, event name, resource, or event source
• Inspect trail configuration: Describe trails, check logging status, and read the event and Insights selectors that decide what gets captured
• Query history with SQL: Run CloudTrail Lake queries across event data stores for analysis that reaches further back than event lookup
• Confirm coverage: Verify that logging is actually enabled and that multi-region and organization trails are delivering

In Sim, CloudTrail is the audit half of the AWS story. Where IAM and Identity Center answer who has access, CloudTrail answers what they actually did with it — so an agent can take a suspicious permission change and trace it back to the principal, the source IP, and the moment it happened, then hand a written timeline to whoever needs to act on it.

This block is read-only with one narrow exception: Cancel Query stops a running CloudTrail Lake query. It never enables or disables logging, alters trail configuration, or deletes a trail. Every operation it ships is covered by this policy, with no residual write risk:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cloudtrail:DescribeTrails",
        "cloudtrail:GetTrail",
        "cloudtrail:GetTrailStatus",
        "cloudtrail:GetEventSelectors",
        "cloudtrail:GetInsightSelectors",
        "cloudtrail:GetEventDataStore",
        "cloudtrail:ListTrails",
        "cloudtrail:ListEventDataStores",
        "cloudtrail:ListTags",
        "cloudtrail:LookupEvents",
        "cloudtrail:StartQuery",
        "cloudtrail:DescribeQuery",
        "cloudtrail:GetQueryResults",
        "cloudtrail:CancelQuery"
      ],
      "Resource": "*"
    }
  ]
}

cloudtrail:CancelQuery is the action Cancel Query needs, and it is not implied by Describe*, Get*, or List* — omit it and that one operation fails with an access-denied error. Note that Start Query is billed per GB scanned and consumes your account's concurrent-query quota of 10.

Lookup Events is limited by AWS to two requests per second per account per Region. Each call uses AWS adaptive retry mode and allows up to six attempts, so a throttled request backs off exponentially with jitter and usually succeeds instead of surfacing an error. That is a retry budget, not a guarantee: sustained throttling past six attempts fails the call with a ThrottlingException, and because a fresh SDK client is built per invocation, adaptive mode's client-side rate limiter carries no pacing state between calls. Lookup Events also returns one page per call — feed nextToken back in to walk a broad search, and expect to handle a throttling error on a long paging loop.

Usage Instructions

Integrate AWS CloudTrail into workflows. Look up the last 90 days of management and Insights events by user, event name, resource, or access key; inspect trail configuration, logging status, and event selectors; and run SQL queries against CloudTrail Lake event data stores. This block never changes trail or event data store configuration, and never starts or stops logging. Starting and cancelling a Lake query are the only actions that are not reads, and AWS bills Lake queries on the data they scan. Requires AWS access key and secret access key.

Actions

CloudTrail Look Up Events

Look up AWS CloudTrail management or Insights events from the last 90 days in a Region

Input

Output

CloudTrail Describe Trails

Retrieve the full configuration of one or more CloudTrail trails in the current Region

Input

Output

CloudTrail Get Trail

Retrieve the settings of a single CloudTrail trail by name or ARN

Input

Output

CloudTrail Get Trail Status

Check whether a CloudTrail trail is logging and surface its most recent delivery errors

Input

Output

CloudTrail List Trails

List the ARN, name, and home Region of every CloudTrail trail visible to the account

Input

Output

CloudTrail Get Event Selectors

Read which management, data, and network activity events a CloudTrail trail is configured to log

Input

Output

CloudTrail Get Insight Selectors

Read which CloudTrail Insights types are enabled on a trail or event data store

Input

Output

CloudTrail Start Query

Start a CloudTrail Lake SQL query over an event data store

Input

Output

CloudTrail Describe Query

Check the status, run time, and scan statistics of a CloudTrail Lake query

Input

Output

CloudTrail Get Query Results

Fetch a page of result rows from a finished CloudTrail Lake query

Input

Output

CloudTrail Cancel Query

Cancel a running CloudTrail Lake query

Input

Output

CloudTrail List Event Data Stores

List the CloudTrail Lake event data stores in the account for the current Region

Input

Output

CloudTrail Get Event Data Store

Retrieve the configuration of a single CloudTrail Lake event data store

Input

Output

CloudTrail List Tags

List the tags on CloudTrail trails, event data stores, dashboards, or channels

Input

Output