How to Export and Review AWS CloudTrail Logs
Summary
A practical guide to exporting CloudTrail management and data events, handling regional and retention limits, and reviewing logs for suspicious activity and collection issues.
Key points
- CloudTrail Event history retains 90 days of management events per region; use trail files in S3 for older logs and data events.
- Export events through the console, the lookup-events CLI command, or trail files in S3; CloudTrail Lake can query stored events with SQL.
- Check trail status and permissions, including lookup-events access or S3 list/read access and kms:Decrypt for encrypted logs.
- Review events such as unexpected ConsoleLogin activity, new users or access keys, policy changes, StopLogging, unusual AssumeRole activity, and bursts of denied or data-access events.
- Event history and trail files may omit events because of region selection, disabled data-event logging, retention limits, permissions, or CLI throttling.
- The article recommends sanitizing logs before review in LogTotal at logtotal[.]com.
Article Details
- Defense Focus
- Export and review AWS CloudTrail audit logs to investigate cloud activity and identify suspicious account use, logging changes, role assumptions, and data access.
- Detection Methods
- Review ConsoleLogin events for MFA status, failures, and unfamiliar source IP addresses.
- Look for CreateUser, CreateAccessKey, and AttachUserPolicy events that may indicate new identities, keys, or privilege changes.
- Investigate StopLogging, DeleteTrail, and PutEventSelectors events for changes that reduce CloudTrail visibility.
- Review AssumeRole events from unusual sources, bursts of AccessDenied errors, and bursts of GetSecretValue or GetObject events.
- Data Sources
- CloudTrail management events from Event history
- CloudTrail trail files stored in S3, including data events when configured
- CloudTrail Lake event data
- CloudTrail event fields including additionalEventData.MFAUsed, source IP, and errorCode
- Rule Types
- CloudTrail detection rules
- SQL queries over CloudTrail Lake events
- Platforms
- AWS cloud environment
- Defensive Actions
- Check configured trails and their logging status with describe-trails and get-trail-status.
- Query the correct region; check us-east-1 for IAM events and loop across regions when broader coverage is needed.
- Use trail files in S3 for history beyond Event history’s 90-day window and for recorded data events.
- Enable S3 data events on a trail if future GetObject visibility is required.
- Verify bucket permissions and kms:Decrypt access when trail files cannot be read.
- Use narrower time windows to reduce lookup-events throttling, and inspect download filters before exporting.
- Unwrap CloudTrailEvent JSON strings and flatten trail Records into one event per line for review.
- Review account IDs, ARNs, IP addresses, access key IDs, and usernames before continuing after log sanitization.
MITRE ATT&CK
T1078.004 · Cloud AccountsThe article cites misuse of cloud accounts as a CloudTrail detection use case.T1530 · Data from Cloud StorageThe article cites data theft from cloud storage and recommends investigating bursts of GetObject events when S3 data events are recorded.T1562.008 · Disable or Modify Cloud LogsThe article cites attackers switching off cloud logging and recommends reviewing StopLogging and DeleteTrail events.
Vendors
Products
CloudTrailFor the last 90 days of management events, use the CloudTrail console (Event history → Download events → JSON) or aws cloudtrail lookup-events.CloudTrail LakeIf you use CloudTrail Lake, you can run SQL over your events and save the results instead.LogTotalUpload, sanitize and review in LogTotalPrime CorePrime Core has 262 detection rules for CloudTrail, mapped to 177 MITRE ATT&CK techniques.S3For anything older, or for data events like S3 object reads, read your trail’s log files in S3.