LEARN. PRACTICE. GROW.Concept and mechanism
Management events and data events answer different questions. A default CloudTrail trail does not automatically record data events such as S3 GetObject reads. Configuration should identify resources and operations needing evidence. Selectors can limit scope to one prefix or writes only; those records do not establish reads in another prefix. Define the use case first, estimate volume and cost, and validate capture with controlled events. Also document configuration changes and outage periods. An empty search result is interpretable only when the population of events that could have been observed is understood.
Guided application
In a fictional audit request, the team enables data events after the month requiring investigation. This improves future capture but does not automatically reconstruct the past. Seek existing sources such as access or application logs and state correlation limits. The same role administering the service should not be able to erase all evidence without control; separate authority and monitor capture changes. A report covering two hours without ingestion should state the gap without asserting compromise or guaranteeing no incidents. At handover, provide APS with selectors, retention, owners, failure alerts, and the procedure for validating the chain. Logging is useful when it can answer agreed operational questions.
A write selector on prefix A does not establish reads on prefix B.
Common pitfalls
Trail as all-event capture; absence as proof; activation as history; long retention with unrestricted deletion.
Related topics: Architecture, responsibilities, and portability · Versions, retention, and holds · Data protection, location, and classification
Explain what was captured, what was excluded, and what can be concluded.
Reference: CloudTrail data events · CCSP examination outline effective 2026-08-01; January2026 V2 PDF