Cloud › Module 4 › Lesson 2
CloudTrail Named
CloudTrail named literacy covers API audit trails, multi-region trails, log integrity, and S3 delivery — enable and read patterns on YOUR $CLOUD_LAB.
Visual · t31_cloudtrail_named
CloudTrail literacy. $CLOUD_LAB only. Original Cyberlium.
Opening
No trail means no story — literacy names what CloudTrail captures so you investigate IAM and S3 changes on accounts you own.
CloudTrail records AWS API management events — who called iam:CreateUser, s3:PutBucketPolicy, ec2:AuthorizeSecurityGroupIngress. Best practice: organization or account trail, all regions, log file validation, encrypted S3 bucket for delivery, CloudWatch Logs integration optional for alerting. Without trails, misconfig and compromise investigations go blind. Cyberlium maps CloudTrail checklist on YOUR $CLOUD_LAB — enable on sandbox if within free tier; otherwise paper design. Next: GuardDuty Named.
1. CloudTrail components (named)
Management events: control plane API calls. Data events: optional S3 object-level (cost). Trail: delivery to S3 with KMS encryption. Log file validation: detect tampering. Multi-region: capture activity in all regions.
On $CLOUD_LAB, write CloudTrail enablement checklist — regions, validation, bucket, encryption.
Command guide
Try these commands — CloudTrail components (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CloudTrail — https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html CloudTrail org trails — https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-and-update-an-organisation-trail.html AWS logging — https://docs.aws.amazon.com/security/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
pipx install awscli # or official AWS CLI v2
macOS:
Command — copy this
brew install awscli
Windows: Install AWS CLI v2 from Amazon
═══ LINUX / macOS ═══
Command — copy this
export CLOUD_LAB=${CLOUD_LAB:-$HOME/cyberlium-lab/t31-cloud}
cat > "$CLOUD_LAB/aws/cloudtrail-checklist.md" <<'EOF'
# CloudTrail Checklist — YOUR ACCOUNT
- [ ] Multi-region trail enabled
- [ ] Log file validation enabled
- [ ] Logs encrypted with KMS
- [ ] S3 bucket not public; restricted bucket policy
- [ ] CloudWatch Logs integration for alerting
- [ ] Management events + data events (where needed)
Review trails in YOUR account — literacy for detection and forensics
EOFYOUR ACCOUNT — list trails (read-only)
Command — copy this
aws cloudtrail describe-trails 2>/dev/null || echo 'Configure aws for YOUR account to list trails' grep -E 'Multi-region|CloudWatch|YOUR ACCOUNT' "$CLOUD_LAB/aws/cloudtrail-checklist.md"
Primary tools to practice this lesson: grep, aws. Reference sites: CloudTrail (https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html); CloudTrail org trails (https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-and-update-an-organisation-trail.html); AWS logging (https://docs.aws.amazon.com/security/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why CloudTrail supports IAM and S3 investigations
GuardDuty and manual hunts pivot on unusual API sequences — CreateUser then AttachUserPolicy from new IP. IR timelines need authoritative API history from YOUR account trail.
Students design trail on sandbox — never import stranger account CloudTrail exports without ticket.
3. Lab boundary
Forbidden: disabling trails on employer prod without change ticket. Allowed: CloudTrail named card — five settings with $CLOUD_LAB trail bucket fictional name.
Ship: CloudTrail checklist for YOUR lab account. Next: GuardDuty Named.
4. What you ship: CloudTrail checklist for $CLOUD_LAB
Multi-region, validation, S3 delivery, encryption settings. $CLOUD_LAB named. chmod 600.
5. What you record before the next lesson
Date. CloudTrail checklist. $CLOUD_LAB named. File t31-m04-l02-cloudtrail-named.txt chmod 600.
6. Wrong vs right: stranger tenants vs YOUR cloud accounts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Leave trails off 'to save money' on account with IAM changes. Copy stranger trail export.
Right
Write CloudTrail checklist for YOUR $CLOUD_LAB. Next: GuardDuty Named.
Mission: design CloudTrail on YOUR lab account
1) Name trail and log bucket fictional IDs. 2) List multi-region and validation settings. 3) Note one API event you would hunt (iam:*). 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Log file validation is cheap insurance against tampered audit logs.
Knowledge Check
APPLY: CloudTrail primarily records:
Multiple choice
Knowledge Check
APPLY: True or False: Multi-region trails help capture API activity outside one region.
True or False
Knowledge Check
APPLY: CloudTrail literacy on Cyberlium uses:
Multiple choice