CloudTrail Flashcards
CloudTrail
How do you turn on CloudTrail?
On (enabled) by default, except for CloudFront and other global things
CloudTrail
How long stored?
Last 90 days for free
CloudTrail
Where are CloudTrail things stored?
In CloudTrail
CloudTrail
What if you want more than the CloudTrail limit on past events?
Create a Trail
CloudTrail
Attributes of a Trail you create?
S3 bucket to store events in, keys to encrypt, target CloudWatch Log Group
CloudTrail
Three types of events captured in CloudTrail?
Management Events (control plane), Data Events (data plane), Insight Events
CloudTrail
What is captured by default?
Management Events. Data Events are not 100% captured; have to turn on separately
CloudTrail
What about global services like CloudFront?
Off by default, can be turned on for any Trail, always log to us-east-1
CloudTrail
Two types of Trails you can create?
One Region trail, All Regions trail
CloudTrail
How does a One Region Trail work?
Everything lives in a single region
CloudTrail
How does an All Regions Trail work?
Collects data in every region, but managed as a single Trail
CloudTrail
Major product for aggregating CloudTrail across accounts?
Organizations: set up a Trail in management account to aggregate across all OU accounts.
CloudTrail
Is CloudTrail real-time?
No, has around 15 minute delay
CloudTrail
Cost structure of CloudTrail?
Default trail of 90 days and copy to S3 is free. Data Events and additional Trails have a cost.
CloudTrail
Are Security Group changes logged by default?
Yes
CloudTrail
Are Lambda invocations logged by default?
No
CloudTrail
Are Role Assumptions logged by default?
Yes
CloudTrail
Are Account logins logged by default?
Yes
Log File Integrity
What is Log File Integrity?
Can verify if a trail file has been tampered with
Log File Integrity
How does Log File Integrity work?
important
Writes a digest (manifest) file every hour with details on each trail file
Log File Integrity
Where can you find the digest files?
important
Same S3 bucket, but different folder
so you can control access separately
Log File Integrity
Can Log File Integrity determine if a trail file is missing?
important
Yes: look in the digest
Log File Integrity
What’s inside a digest file?
Hash of every trail file
Log File Integrity
How can you trust the digest files?
Each has signature of previous digest; signed by CloudTrail private key
Log File Integrity
How can you tell if a digest file was deleted?
important
Signature in next digest file doesn’t match previous digest file
