AWS CLOUD Trail and GuardDuty service
one short security - aws security - last min rev
How cloud trail works
An activity happens in your account
cloud tril captures and records the activity which referred to as cloud trail event it contains details like
- Who performed the request
- when the event occured date,time of request
- what the source Ip was
- how request was made
- which actions were performed
- where the actions occured (in which region)
- what the response was
Note
ALL log files are stored as compressed files with a .gz extension
cloud trail best practices
turn on cloud trail log file integrity validation
aggregate log files to single s3 bucket
ensure that cloudtrail isenabled across aws globally
restrict access to cloud trail s3 buckets
integrate with amazon cloudwatch
Guard duty Detection
