Lesson 03 — AWS CloudTrail Enterprise Logging Architecture, Audit Trails & Organisation-Wide Governance

Learning Path

☁️ Phase 02 – AWS Cloud Security

📘 Module 13 – Enterprise Security Operations, Logging, Monitoring & Threat Detection

🎯 Lesson Objectives

By the end of this lesson you will be able to:

Explain AWS CloudTrail architecture.
Understand CloudTrail logging capabilities.
Deploy enterprise CloudTrail architectures.
Design organisation-wide audit logging.
Configure multi-account logging.
Configure multi-Region trails.
Understand Management Events.
Understand Data Events.
Understand Network Activity Events.
Configure Advanced Event Selectors.
Configure CloudTrail Lake.
Enable Log File Validation.
Design secure CloudTrail storage.
Integrate CloudTrail with CloudWatch.
Integrate CloudTrail with EventBridge.
Design CloudTrail governance.
Investigate CloudTrail events.
Protect CloudTrail against attackers.
Design enterprise audit architectures.
Implement CloudTrail best practices.

📚 Lesson Information

Area	Details
Estimated Time	8–10 Hours
Difficulty	Advanced
Prerequisites	Lesson 02
Hands-on Labs	Yes
AWS Services	CloudTrail, CloudTrail Lake, CloudWatch Logs, S3, KMS, EventBridge, Organizations

💼 Business Scenario

CloudNova Technologies operates:

500 AWS Accounts
12 AWS Regions
Production workloads
PCI DSS
HIPAA
ISO 27001
SOC 2
GDPR

Following a recent penetration test, auditors discovered:

CloudTrail disabled in several development accounts.
Some Regions not monitored.
Data Events not enabled.
No Log File Validation.
Developers able to stop CloudTrail.
CloudTrail logs stored locally instead of the Log Archive account.
No delegated administrator.
No CloudTrail Lake for investigations.
Missing organisation trails.

The CISO asks:

“How can we ensure every AWS API call across every account is securely logged, centrally stored and available for investigation?”

1. Introduction to AWS CloudTrail

What is AWS CloudTrail?
Why CloudTrail is critical for cloud security.
Shared Responsibility Model.
CloudTrail vs CloudWatch.
CloudTrail vs AWS Config.
CloudTrail vs Security Hub.

2. CloudTrail Architecture

Explain:

Trail
Event History
Event Data Store
CloudTrail Lake
S3 Storage
CloudWatch Logs Integration
EventBridge Integration
AWS Organizations Integration

Architecture Diagram

AWS Services

↓

CloudTrail

↓

S3 Log Archive

↓

CloudWatch Logs

↓

CloudTrail Lake

↓

Security Lake

↓

SIEM

↓

SOC

3. CloudTrail Components

Cover:

Trails
Event History
Event Data Stores
Channels
Lake
Insights
Event Selectors

4. CloudTrail Event Types

Management Events

Data Events

Network Activity Events

Insights Events

Comparison table.

5. Management Events

Explain:

Read Events
Write Events

Examples:

CreateUser

DeleteBucket

PutBucketPolicy

CreateRole

AssumeRole

TerminateInstances

DeleteTrail

etc.

6. Data Events

Examples:

S3 Object Access

Lambda Invoke

DynamoDB API

S3 DeleteObject

S3 PutObject

S3 GetObject

Cost considerations.

7. Network Activity Events

Explain:

VPC Endpoint events
Supported services
Enterprise use cases

8. Event History

Limitations

Retention

Searching

Advantages

9. Trails

Single Region

Multi Region

Organization Trails

Best practices

10. Organization Trails

Architecture

Delegated Administrator

Security Account

Log Archive

Cross-account logging

11. Multi-Region Trails

Benefits

Disaster Recovery

Compliance

Visibility

12. Event Selectors

Basic Event Selectors

Advanced Event Selectors

Filtering

Cost optimisation

13. CloudTrail Insights

Purpose

API anomalies

Rate anomalies

Use cases

Limitations

14. CloudTrail Lake

Architecture

Event Data Stores

Query Engine

Retention

Pricing

SQL Queries

Investigation examples

15. CloudTrail Log File Validation

Hashing

Integrity

Validation

Tamper Detection

16. CloudTrail Security

Encryption

KMS

S3 Policies

Bucket Policies

Least Privilege

MFA Delete

Object Lock

17. CloudTrail Governance

Ownership

Naming

Retention

Encryption

Lifecycle

Versioning

Cross Account

Monitoring

18. CloudTrail Threat Model

Attacker disables CloudTrail

Deletes Logs

Deletes Trail

Stops Logging

Changes Bucket Policy

Deletes KMS Key

Changes Event Selectors

Removes Validation

19. Enterprise CloudTrail Architecture

AWS Organizations

↓

Organization Trail

↓

Multi Region Trail

↓

Central Log Archive Account

↓

CloudWatch Logs

↓

CloudTrail Lake

↓

Security Lake

↓

SIEM

↓

SOC

20. Enterprise Investigation Workflow

CloudTrail

↓

GuardDuty

↓

Security Hub

↓

CloudWatch

↓

CloudTrail Lake

↓

SOC

↓

Incident Response

🛠 Enterprise Labs

Lab 01

Create Enterprise CloudTrail

Lab 02

Configure Organization Trail

Lab 03

Configure Multi Region Trail

Lab 04

Configure Log Archive

Lab 05

Enable Log File Validation

Lab 06

Configure Advanced Event Selectors

Lab 07

Enable CloudTrail Lake

Lab 08

Investigate IAM Activity

Lab 09

Investigate S3 Data Events

Lab 10

Enterprise CloudTrail Assessment

💻 AWS Console Walkthrough

Students should configure:

Event History
Trails
Organization Trails
Multi Region Trails
CloudTrail Lake
Event Data Stores
Insights
Event Selectors
Log Validation

💻 AWS CLI Exercises

aws cloudtrail describe-trails

aws cloudtrail get-trail-status

aws cloudtrail lookup-events

aws cloudtrail get-event-selectors

aws cloudtrail put-event-selectors

aws cloudtrail describe-event-data-stores

aws cloudtrail start-query

aws cloudtrail get-query-results

aws cloudtrail list-channels

✅ Verification Checklist

Students should be able to:

Explain CloudTrail architecture.
Configure organisation trails.
Configure multi-Region logging.
Configure advanced event selectors.
Enable data events.
Enable network activity events.
Configure CloudTrail Lake.
Query CloudTrail Lake.
Enable log validation.
Secure CloudTrail.

🏢 Enterprise Best Practices

CloudNova standards include:

Enable an organisation trail covering all Regions.
Store logs in a dedicated Log Archive account.
Encrypt CloudTrail logs using customer-managed KMS keys.
Enable Log File Validation.
Enable Data Events for business-critical workloads.
Monitor CloudTrail health continuously.
Restrict permissions to modify or stop trails.
Integrate CloudTrail with CloudWatch, EventBridge and Security Lake.
Regularly review event selectors and retention policies.

🚫 Common Mistakes

Only enabling Event History.
Logging a single Region.
Ignoring Data Events.
Disabling Log File Validation.
Storing logs in workload accounts.
Allowing developers to stop trails.
Using inconsistent naming conventions.
Not monitoring CloudTrail failures.
Ignoring CloudTrail costs.
Not testing CloudTrail during incident simulations.

🧪 DIY Enterprise Challenge

Design CloudNova’s enterprise CloudTrail architecture supporting:

500 AWS accounts
Multi-Region logging
Organisation Trails
Log Archive account
CloudTrail Lake
Security Lake integration
SIEM integration
Immutable storage
Cross-account governance
Compliance requirements

Prepare:

CloudTrail architecture
Organisation-trail design
Event-selector strategy
Data-event strategy
CloudTrail Lake design
Security model
Cost-optimisation strategy
Operational runbook

📊 Knowledge Check

Create and answer 50 enterprise-level questions covering:

CloudTrail architecture
Event History
Trails
Organisation Trails
Multi-Region Trails
Management Events
Data Events
Network Activity Events
CloudTrail Lake
Event Data Stores
Insights
Event Selectors
Log File Validation
CloudTrail governance
Enterprise investigations

💡 Key Takeaways

After completing this lesson, you should be able to:

Design and deploy enterprise CloudTrail architectures.
Implement organisation-wide audit logging across AWS Organizations.
Secure CloudTrail using encryption, log validation and least privilege.
Configure advanced event selectors and CloudTrail Lake for scalable investigations.
Integrate CloudTrail with enterprise monitoring and security platforms.
Use CloudTrail as the foundational audit service for Security Operations, Incident Response and compliance.

🚀 Next Lesson

➡️ Lesson 04 — Amazon CloudWatch Logs, Metrics, Dashboards & Enterprise Monitoring Architecture