Implementing AWS CloudTrail log analysis for security monitoring, threat detection, and forensic investigation using Athena, CloudWatch Logs Insights, and SIEM integration to identify unauthorized access, privilege escalation, and suspicious API activity.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Implementing AWS CloudTrail log analysis for security monitoring, threat detection, and forensic investigation using Athena, CloudWatch Logs Insights, and SIEM integration to identify unauthorized access, privilege escalation, and suspicious API activity.
When building security monitoring pipelines for AWS API activity
When investigating security incidents to trace attacker actions across AWS services
When compliance requires audit logging of all administrative and data access operations
When creating detection rules for known attack patterns in AWS environments
When establishing baseline API behavior for anomaly detection
Do not use for real-time threat detection (use GuardDuty which already analyzes CloudTrail), for application-level logging (use CloudWatch Application Logs), or for network traffic analysis (use VPC Flow Logs).
Common Misconfigurations & Verification
Single-region / non-org trail: a trail without --is-multi-region-trail and --is-organization-trail leaves whole regions and member accounts unlogged, so attacker activity in an unmonitored region is invisible. Confirm both flags in describe-trails.
Log file validation off: without --enable-log-file-validation you cannot prove logs were not altered, undermining forensics. Verify LogFileValidationEnabled: true.
No data events: management events alone miss S3 GetObject/PutObject and Lambda Invoke. Add advanced event selectors with eventCategory = Data and confirm via get-event-selectors.
Logging stopped or never started: a trail can exist but be inactive. Check get-trail-status shows IsLogging: true and no recent StopLogging.
Athena partitions missing: queries against unpartitioned/un-added partitions return empty results — looks "clean" but scanned nothing. Add the partition or use partition projection.
Expecting real-time: delivery to S3/CloudWatch lags up to ~15 min; use CloudTrail Lake or Logs Insights for live incidents.
AWS service that records API calls made to AWS services, providing an audit trail of actions taken by users, roles, and services
Management Events
CloudTrail events for control plane operations like creating resources, modifying IAM, and configuring services
Data Events
CloudTrail events for data plane operations like S3 object access and Lambda function invocations, providing granular activity logging
Log File Validation
CloudTrail feature that creates a digest file for verifying that log files have not been tampered with after delivery
CloudTrail Lake
Managed data lake for CloudTrail events enabling SQL-based queries without managing Athena tables or S3 data
Organization Trail
Single trail that captures API activity across all accounts in an AWS Organization to a central S3 bucket
Tools & Systems
Amazon Athena: Serverless SQL query engine for analyzing CloudTrail logs stored in S3 at scale
CloudWatch Logs Insights: Real-time log query service for interactive CloudTrail analysis within the last 30 days
CloudTrail Lake: Managed event data lake with built-in SQL query capabilities and 7-year retention
Amazon Security Lake: Centralized security data lake that normalizes CloudTrail data into OCSF format for SIEM consumption
AWS CloudTrail: Core audit logging service capturing all API activity across AWS accounts and services
Common Scenarios
Scenario: Investigating an IAM Credential Compromise Through CloudTrail
Context: GuardDuty alerts on UnauthorizedAccess:IAMUser/MaliciousIPCaller for a developer's access key. The security team needs to trace all actions taken by the compromised credential.
Approach:
Query CloudTrail for all events by the compromised AccessKeyId across all regions
Build a timeline of API calls to understand the attack sequence
Identify the initial access point (when did the key first appear from a malicious IP)
Map all resources created, modified, or accessed by the attacker
Check for persistence mechanisms (new users, access keys, Lambda functions, EC2 instances)
Verify CloudTrail was not tampered with (check for StopLogging or UpdateTrail events)
Document the full attack chain and scope of impact for the incident response report
Pitfalls: CloudTrail events can take up to 15 minutes to appear in S3 and CloudWatch Logs. For real-time visibility during active incidents, use CloudTrail Lake or CloudWatch Logs Insights rather than Athena queries against S3. Cross-region attacks require querying multiple region partitions in Athena.
