CloudTrail and AWS Config

AWS CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. It logs every API call made to the AWS Management Console, AWS SDKs, command line tools, and other AWS services. CloudTrail records the who, what, when, and where of every action taken in your account.

When an API call is made, CloudTrail captures the event and delivers it to an S3 bucket (for long-term storage) and optionally to CloudWatch Logs (for real-time monitoring). Each event includes details like the identity of the caller (IAM user or role), the time of the call, the source IP address, the request parameters, and the response elements. CloudTrail can log events from all regions (default) or a single region. The default retention period for CloudTrail events in the management console is 90 days, but logs stored in S3 persist until you delete them.

A typical CloudTrail event in JSON format includes:

{
  "eventVersion": "1.08",
  "userIdentity": {
    "type": "IAMUser",
    "arn": "arn:aws:iam::123456789012:user/Admin",
    "accountId": "123456789012",
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "userName": "Admin"
  },
  "eventTime": "2023-01-01T00:00:00Z",
  "eventSource": "ec2.amazonaws.com",
  "eventName": "RunInstances",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "203.0.113.0",
  "userAgent": "console.amazonaws.com",
  "requestParameters": {
    "instanceType": "t2.micro",
    "imageId": "ami-0abcdef1234567890"
  },
  "responseElements": {
    "instancesSet": {
      "items": [
        {
          "instanceId": "i-1234567890abcdef0"
        }
      ]
    }
  }
}

CloudTrail can optionally sign log files using SHA-256 hashing and a digital signature. This allows you to verify that log files have not been tampered with after delivery. The validation uses a digest file that contains references to the log files and their hashes.

AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. It records resource configuration changes and evaluates them against desired configurations (rules). Config provides a detailed view of the configuration history of each resource and helps you ensure compliance with internal policies and regulatory standards.

AWS Config continuously monitors and records your AWS resource configurations. When a resource is created, modified, or deleted, Config records the change as a configuration item (CI). Each CI includes metadata about the resource, its relationships to other resources, and the time of the change. Config also allows you to define rules (AWS managed or custom) that evaluate whether your resources comply with your desired configurations. If a resource violates a rule, Config generates a compliance change notification.

Config rules are evaluated periodically (e.g., every 10 minutes for some managed rules) or on configuration changes. When a rule is triggered, Config evaluates the resource against the rule logic and returns one of: COMPLIANT, NON_COMPLIANT, NOT_APPLICABLE, or INSUFFICIENT_DATA. You can set up remediation actions to automatically fix non-compliant resources.

CloudTrail and Config complement each other. CloudTrail logs the API calls that change resources, while Config records the resulting configuration state. For example, if an IAM user calls CreateBucket, CloudTrail logs that API call. Config then detects the new bucket and records its configuration. If you have a rule that requires buckets to be encrypted, Config will evaluate the new bucket and mark it as non-compliant if encryption is not enabled.

# Create a CloudTrail trail
aws cloudtrail create-trail --name my-trail --s3-bucket-name my-bucket

# Start logging
aws cloudtrail start-logging --name my-trail

# List trails
aws cloudtrail list-trails

# Enable AWS Config
aws configservice subscribe --s3-bucket my-bucket --sns-topic arn:aws:sns:us-east-1:123456789012:config-topic

# List config rules
aws configservice describe-config-rules

# Get compliance details
aws configservice get-compliance-details-by-config-rule --config-rule-name required-tags

A financial services company needs to investigate a data breach. They use CloudTrail to identify that an IAM user with administrative privileges called s3:GetObject on a sensitive bucket from an unusual IP address at 3 AM. The CloudTrail log shows the user's ARN, the source IP, and the request parameters. They then use AWS Config to check the bucket's current configuration – they find that the bucket policy was changed to allow public access 2 hours before the breach. Config's configuration timeline shows the exact change and the previous policy. The security team can now trace the responsible user and revert the policy. In production, they maintain a multi-region trail sending logs to a centralized S3 bucket in a security account, with log file validation enabled to ensure integrity. They also have Config rules that alert on any public access changes and automatically remediate using an SSM automation document.

A retail company must comply with PCI DSS, which requires logging all access to cardholder data and monitoring configuration changes. They enable CloudTrail to log all management and data events for S3 buckets containing cardholder data. They also enable AWS Config with managed rules like s3-bucket-ssl-requests-only and encrypted-volumes. Config automatically evaluates resources every time a change occurs and generates compliance reports. During an audit, the auditor reviews the CloudTrail logs to verify that only authorized users accessed the data, and the Config compliance dashboard shows that all resources are compliant. The company also uses Config aggregator to consolidate compliance data from multiple accounts (development, test, production) into a single view. A common pitfall is forgetting to enable data events for the specific S3 buckets, which would leave gaps in the audit trail.

A tech startup uses AWS Config rules to enforce tagging policies. They have a rule required-tags that checks if EC2 instances have the 'Environment' tag. When a developer launches an instance without the tag, Config marks it as non-compliant and triggers an automatic remediation action using AWS Systems Manager Automation. The automation document adds the missing tag with a default value. This prevents configuration drift and ensures cost allocation tags are always present. In production, they also use CloudTrail to monitor who created the non-compliant resources and send alerts to the security team. A misconfiguration scenario: if the remediation action fails (e.g., due to IAM permissions), the resource remains non-compliant, and the team must manually intervene. They also set up CloudWatch alarms on Config compliance change notifications to detect repeated failures.