c1.9 Audit account activity
Record who did what in your accounts, and protect that record so it is trustworthy during an investigation. AWS CloudTrail is the native way to do this: enable an organization trail and centralize the logs in a dedicated logging account.
Implementation guidance
Enable, centralize, and protect the logs
AWS CloudTrail records API activity across your accounts — the evidence you need to investigate an incident and reverse an attacker's actions. CloudTrail Event history is free to view online for the last 90 days, but it is deleted after that, so create a trail that delivers logs to an S3 bucket for long-term retention set by your security policy.
Use an organization trail so every account is covered automatically, and centralize the logs in a dedicated Log Archive account so an attacker who compromises a workload account cannot read or delete the audit trail. Protect the bucket (restrictive policies, object lock/immutability) and use SCPs so no one can stop logging or tamper with the files.
Multi-account, done for you
If you use AWS Control Tower / multi-account management, the Log Archive account is provisioned and CloudTrail is centralized and protected automatically — aligning with the AWS Security Reference Architecture.
Be ready to use it
Logs only help if you can read them. Train your security team to search and investigate CloudTrail (console, Athena, or your SIEM) before you need it in an incident.
How it fits together
How to validate
- Is an organization CloudTrail trail enabled so every account is covered?
- Are the logs centralized in a dedicated Log Archive account and protected from deletion/tampering (bucket policy, object lock, SCPs)?
- Can no one stop logging or manipulate the log files (enforced by SCP)?
- Is your team prepared to search and investigate CloudTrail logs?
Threats addressed
- Without a protected, centralized audit trail, an attacker can act without a reliable record — and can delete or alter local logs to cover their tracks. Centralizing and locking down CloudTrail preserves the evidence needed to understand and reverse an incident.
AWS services
AWS CloudTrail 
Amazon S3 
AWS KMS Pricing
AWS CloudTrail — viewing the last 90 days of management events in Event history is free. You pay for trails that deliver events and for the S3 storage they use. See CloudTrail pricing.