Lion Cipher Lab
Set up AWS CloudTrail logging
- Cloud Security
- Beginner
- ~40 min
- Free · no account required
Why it matters
An AUDIT LOG is a durable, time-stamped record of actions taken in a system — who did what, when, and from where — kept so you can review it after the fact. In the cloud, almost everything happens through API calls, so the audit log of your AWS account is a record of those calls: someone created an IAM user, opened a security group to the internet, deleted a database, disabled a control. AWS CloudTrail is the service that produces that record. This matters because detection and forensics both start from the same place: a log. If an account is compromised, the only way to answer 'what did the…
What you'll learn
- what an audit log is and why cloud detection depends on it
- understanding CloudTrail management events (API calls to create/change/delete resources)
- creating a CloudTrail trail that logs to a secured S3 bucket for long-term retention
- enabling log file validation to detect tampering
- searching Event history to find who performed a specific action
- knowing that logging must be enabled BEFORE an incident, not after
Steps in this lab
- What CloudTrail records, in plain terms
- The 90-day reality — why Event history is not enough
- Authorisation first — your own account only
- Create a trail that logs to S3
- Turn on log file validation
- Keep the log bucket locked down
- Read Event history and find a specific action
- What you built, and where it leads