CloudTrail Investigation: Who Did What

CloudTrail is the audit log of every AWS account. As a DevOps Engineer Professional you must be able to deploy a trail correctly, capture both management and data events, and use that audit trail to investigate incidents and prove integrity to auditors.

You will:

• Create a CloudTrail trail writing to S3 encrypted with KMS
• Enable management events plus S3 object-level data events on a target bucket
• Enable log file integrity validation
• Generate diverse API activity (IAM user create/delete, policy attach, S3 put/get/delete)
• Create a CloudTrail Lake event data store and query events with SQL
• Use `aws cloudtrail validate-logs` to confirm digest signatures match log file hashes

This lab uses only confirmed-tier services (CloudTrail, S3, KMS, IAM, STS) and runs reliably under a hardened TeKanAid AWS lab IAM policy.