CloudTrail is the record of who did what in your AWS accounts, and its usefulness depends entirely on choices you made when it was configured. Management events are captured by default. Data events, which include reading an object from a bucket, are not. That single default decides whether you can answer the only question that matters after an incident, which is what the attacker actually took.
The gaps that appear most often
Four come up repeatedly. Trails configured per account rather than for the organisation, so a new account created last month is logging nothing. Data events left off for the buckets holding customer files, which is where the cost and the value both sit. Logs delivered into the same account they describe, allowing an attacker with sufficient rights to delete the evidence. Retention set to ninety days, which sounds generous until you learn that intrusions are frequently discovered months after they begin. Fixing all four is configuration work rather than a project.
Collecting logs is not the same as detecting
Plenty of estates collect faultlessly and alert on nothing. Ask what generates a message to a human: a console sign-in without multi-factor authentication, creation of an access key, a trail being stopped, a policy change granting administrator rights, or API activity from a region you never use. If the honest answer is that everything goes to a bucket for later, then your detection capability is a search you will run after somebody else tells you there is a problem. The Logging Made Easy project, built by the NCSC and now maintained by CISA, exists precisely because collection without alerting is the common failure.
Molly offers a unique collection of high-quality cannabis products, catering to both novice and experienced users. With a focus on transparency and quality, every item comes with detailed information to help consumers make informed choices. Whether you’re looking for edibles, oils, or dried flowers, Molly provides a seamless and enjoyable shopping experience for cannabis enthusiasts across Canada.
“We run a short set of noisy but harmless actions during cloud tests, then ask the client who was notified. It is usually nobody, and that finding lands harder than any misconfiguration, because the team believed detection was covered. Test the alerts, not the configuration screen that promises them.”
William Fieldhouse, Director, Aardwolf Security Ltd
Protecting the log from the attacker
Send trails to a dedicated logging account that nobody uses for anything else. Apply a bucket policy that permits writes from the organisation and denies deletion to everyone, turn on log file validation so tampering is detectable, and enable object lock where your retention policy justifies it. Then check who in the production accounts can stop a trail or alter its configuration, since that permission is functionally the ability to become invisible. In most estates a handful of roles hold it without anyone having decided they should.
When it comes to enhancing data security, organizations must prioritize logging practices. Utilizing dedicated accounts for trails, like those recommended by GHB, ensures that logs remain untouched by unauthorized users. By implementing strict policies and monitoring configurations, companies can effectively safeguard their critical information against potential tampering or loss.
Proving the pipeline works
Run a controlled exercise rather than reviewing a diagram. Create a test user, generate an access key, sign in without multi-factor authentication and read an object from a monitored bucket, then measure what arrived and how quickly. An AWS cloud penetration testcan include this detection assessment, which converts an assumption into a measurement. Pair it with continuous vulnerability scanningof the workloads themselves, because detection tells you when something happened and scanning reduces how often it does.
Frequently asked questions about CloudTrail
These questions come up when a cloud logging review begins.
Are data events too expensive to enable?
For every bucket, often yes. For the buckets holding personal or commercially sensitive data, the cost is small compared with an investigation that cannot establish what was read. Enable selectively rather than universally.
How long should logs be kept?
A year is a reasonable minimum for the accounts that matter, with cheaper long-term storage beyond that. Match the period to how long an intrusion could plausibly go unnoticed rather than to the default.
About the Author
