AWS CloudTrail and Config

AWS CloudTrail and AWS Config keep a record of what happens inside your AWS account. CloudTrail answers the question "who did what and when." Config answers the question "how does each resource look now, and how did it look before."

Think of a building with two systems. Security cameras record every person who walks through a door. That is CloudTrail. A photo album captures how each room was arranged on different dates and flags rooms that break the house rules. That is Config.

The Three Monitoring Services Compared

+---------------+------------------------+--------------------------+
| Service       | Main Question          | Example                  |
+---------------+------------------------+--------------------------+
| CloudWatch    | How is it performing?  | CPU usage hit 90 percent |
| CloudTrail    | Who made the change?   | User Ravi deleted a      |
|               |                        | security group           |
| Config        | What changed and is it | Bucket became public     |
|               | compliant?             | at 3:10 PM               |
+---------------+------------------------+--------------------------+

AWS CloudTrail

CloudTrail records API calls made in your account. Every click in the console, every CLI command, and every SDK request becomes an event. Each event shows the identity, the action, the time, the source IP address, and the affected resource.

Types of Events

• Management events track control actions, such as creating an EC2 instance or changing an IAM policy.
• Data events track activity on data inside resources, such as reading an S3 object or running a Lambda function.
• Insights events flag unusual activity patterns, such as a sudden spike in API calls.

Event History and Trails

CloudTrail turns on Event History by default and keeps the last 90 days of management events. A trail stores events in an S3 bucket for as long as you choose. Create a trail that covers all regions so activity in any region is recorded.

Console click / CLI command / SDK call
              |
              v
      AWS service performs action
              |
              v
        CloudTrail event
         /            \
 Event History      Trail
 (90 days)          (S3 bucket, long-term)
                        |
                 Optional: CloudWatch Logs,
                 alerts, analysis with Athena

A Real-World Question

A teammate reports that a database vanished. Search CloudTrail for the DeleteDBInstance event. The record shows the user name, the exact time, and the IP address. The team knows the answer in minutes.

AWS Config

Config tracks the configuration of your resources over time. It records settings such as security group rules, bucket policies, and instance types. A timeline shows each change and the state before and after.

Config Rules

Rules check whether resources follow your standards. A rule marks each resource as compliant or noncompliant.

• Require encryption on all EBS volumes.
• Block public read access on S3 buckets.
• Require tags such as Owner and Project on every resource.
• Confirm that MFA is active for the root user.

Automatic Remediation

Config can trigger a fix when a resource breaks a rule. A remediation action can turn on encryption or close an open port using Systems Manager automation. Start with notifications before enabling automatic fixes so you understand the effects.

Config Compliance Flow

Someone changes a resource
          |
          v
Config records the new configuration
          |
          v
Config rule evaluates the resource
      /               \
Compliant          Noncompliant
  |                      |
 Done          Notify team / start remediation

Using Both Services Together

An S3 bucket becomes public by mistake. Config detects the noncompliant setting and raises an alert. CloudTrail shows which user changed the bucket policy and at what time. Config supplies the what, and CloudTrail supplies the who.

Security and Audit Benefits

• Investigators reconstruct events after an incident.
• Auditors review evidence of controls and changes.
• Teams detect risky settings before attackers find them.
• Organizations prove compliance with internal policies.

Setup Steps

1. Open CloudTrail and create a trail for all regions.
2. Choose an S3 bucket for the log files and turn on log file validation.
3. Open Config and turn on recording for supported resource types.
4. Add a managed rule such as s3-bucket-public-read-prohibited.
5. Review the compliance dashboard.

Best Practices

• Protect the log bucket with strict permissions and encryption.
• Send logs from all accounts to one central, locked-down account.
• Set alerts for high-risk events such as root user sign-ins.
• Expect storage costs for detailed logs and plan retention accordingly.

CloudTrail and Config give you the visibility needed to run a secure and well-governed AWS environment.