AWS CloudTrail - Create a multi-region workflow to track user and API activity on your AWS account
Tags: beginners, tutorial, aws, security
Published: 2022-07-20 15:26:00

### Do you need more security for your AWS account?

In the previous [blog](https://dev.to/aws-builders/aws-cost-explorer-cost-anomaly-detection-report-identifed-an-unauthorized-amazon-sagemaker-canvas-user-3524) I implemented several steps to reduce costs and protect unauthorized user access to an AWS account. 


![rootaccount](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qzcpqtpzspf5mjwqgbi1.jpg)

These remediation steps included:

a) Block public access to S3 buckets enabled
b) Linking Multi-Factor Authentication (MFA) to your AWS Root Account
c) Cleaning up and deleting inactive AWS services
d) Deleting Users that are not listed under AWS IAM
e) Resetting the passwords to your AWS IAM and Root accounts
f) Resetting the passwords to your email accounts
g) Creating MFA on your email accounts
h) Monitor for AWS service usage using AWS Cloud Watch
i) Creating a Cost Anomaly Detection Report from AWS Cost Explorer

If you would like to monitor unauthorized access by a user you may also create an AWS CloudTrail.

### AWS CloudTrail

AWS CloudTrail may be used for compliance by providing an audit review of user actions and API usage by monitoring the event from [a user, role or AWS service](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html) as an event with log data stored in a S3 bucket.

CloudTrail may monitor and record the user actions across all AWS services by creating trail in a single region or multiple regions.

### Architecture

The architecture of a CloudTrail [workflow](https://aws.amazon.com/cloudtrail/) is shown below in the AWS diagram:


![architecture](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/aoa3gda2ueo2kqabbemd.jpg)

The workflow commences with:

Step 1: Unusual user or API activity is recorded by CloudTrail

Step 2: Event history logs is stored in a S3 bucket created by CloudTrail

Step 3: Unusual user or API activity is monitored, the recorded event history for the last 90 days may be viewed by creating an optional [insights events dashboard](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-insights-events-console.html#downloading-insights-events) which may be downloaded as a csv or json file.

Step 4: The CloudTrail console will analyze recent events


### Tutorial 1: Create a CloudTrail for multiple regions using the AWS Console

Step 1: Ensure you have created an [AWS account](https://dev.to/aws-builders/getting-started-with-aws-a-sweet-journey-5cjj)

Step 2: Create IAM permissions for [CloudTrail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/security_iam_id-based-policy-examples.html#grant-permissions-for-cloudtrail-administration)

Step 3: Navigate to the search bar and type the word **CloudTrail**

![Inavigate tobar](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4ybjnkyjznvmnoh2gxua.jpg)

Step 4: On the CloudTrail homepage, click the orange button **Create a trail**

![create trail](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/j6696uoo6bxffv7gjifn.jpg)

Step 5: Create a name for the trail that describes the purpose of the trail.

Step 6: Click **Create new S3 bucket** and provide a name for the S3 bucket created by CloudTrail. Click **Next**

The diagram below is confirmation of the creation of the S3 bucket:

![trail created](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/321q9366efyy4ry64s4q.jpg)

Step 7: Under **Choose log events** you may retain the default settings and select **Save Changes**.


![management](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ta5effsgyrgox1x0tl98.jpg)

Step 8: There is confirmation of the creation of the CloudTrail

![trail](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qf72fps78sdnmljpv219.jpg)

You may navigate to recent trail events from the CloudTrail dashboard.

![trail dashn](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/aldn7nyo0n2v4toc9qsz.jpg)
### Tutorial 2 (Optional): Add Insights Events

CloudTrail is available under the AWS Free Tier and please review  pricing of Insights Events [here](https://aws.amazon.com/cloudtrail/pricing/) as you may incur additional charges.

Step 1: Click into the created CloudTrail and scroll down to **Events** and click **Edit**, Check the box 'insights events'.

![check box](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/n6xju60vmrou4pz482ex.jpg)

Step 2: Check the box **Insight Events** and then check the last two boxes 'API error rate' and 'API call rate'.

![click insight events](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cjvjj2wpu1f55ttdmwmc.jpg)

After 24 hours you will be able to view insights from your dashboard.

![insight graph](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8eruqyrunpjcebmtksos.jpg)

### Tutorial 3 (Optional): Create Cloud Watch on CloudTrail

Navigate to **CloudWatchLogs** and click 'enabled' and **Save Changes**.

![cloudwatch](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ctwkman4ssvjncvg5t5z.jpg)

### Conclusion

You will have the peace of mind to allow AWS CloudTrail to track all user and API activity across your AWS services in multiple regions, where log data is stored in your S3 bucket to review for audit purposes. You will also have access to a dashboard to visualize more granular insights that you may require to help you understand event history for your AWS account.

Until next time, happy learning! 😁 

### Resources

[What is AWS CloudTrail?](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html)

[Create a CloudTrail using AWS Console](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-tutorial.html)

[Create Insight Events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-insights-events-with-cloudtrail.html)

### Join us for AWS re:Inforce conference

Next week is AWS re:Inforce conference, 26-27 July 📆 

A learning conference on compliance, privacy and identity 🔐🛠️

• Register to watch the keynote & sessions streamed live online 📺

• Link: https://reinforce.awsevents.com


![Reinforce](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/sjrctympdeoqdzdir9zu.jpg)