Amazon Web Services (AWS) logs
When you have resources located on Amazon Web Services (AWS), and you need to audit the overall activity of the platform, you need to enable AWS CloudTrail. When you enable this feature, all activities that are occurring in your AWS account will be recorded in a CloudTrail event.
These events are searchable and are kept for 90 days in your AWS account. Here you have an example of a trail:
Figure 17.3: Trails shown in AWS
If you click Event history, in the left navigation, you can see the list of events that were created. The list below has interesting events, including the deletion of a volume and the creation of a new role:
Figure 17.4: Event history in AWS
This is a comprehensive list of all events that were tracked. You can click on each one of those events to obtain more detailed information about it, as shown below:
Figure 17.5: Specific event information when clicking on one of the events listed in AWS
...
