Security Logging and Monitoring
Log sources and their defaults
CloudTrail records API activity. Management events are recorded by default on a trail you create, but S3 object-level and Lambda Invoke data events are not - they are high volume and must be enabled explicitly. Event history in the console holds 90 days of management events. A multi-Region organization trail with log file validation and SSE-KMS gives you centralized, tamper-evident logs in a log-archive account. CloudTrail Insights surfaces anomalous API call volume; CloudTrail Lake gives a queryable event data store with long configurable retention.
VPC Flow Logs capture IP-level metadata (5-tuple, bytes, ACCEPT/REJECT) at the VPC, subnet, or ENI level - not payload, not host processes, and not hostnames. Route 53 Resolver query logs give you DNS names, which is where beaconing and exfiltration usually surface.
Other sources to know: ALB/NLB access logs, CloudFront logs, WAF logs, Network Firewall logs, S3 server access logs, and CloudWatch Logs from agents and applications.
Turning logs into alarms
CloudWatch Logs metric filters plus alarms are the canonical pattern: a filter pattern over a log group (for example { ($.eventName = "ConsoleLogin") && ($.additionalEventData.MFAUsed = "No") }), an alarm, and an SNS fan-out. Logs Insights is for ad-hoc queries, subscription filters stream to Kinesis or Lambda, and cross-account destinations centralize delivery.
AWS Config is a configuration recorder, not a log stream: it evaluates resource state against rules and can remediate through SSM Automation, but it never blocks an API call.
Traps
"CloudTrail logs everything" is false - data events are opt-in. Flow Logs are not real time; the default aggregation interval is 10 minutes. Deleting a trail does not delete logs already delivered to S3, which is exactly why the bucket policy on the archive account matters.
Rule of thumb: who did what to which API → CloudTrail; who talked to whom on which port → VPC Flow Logs; which domain was resolved → Resolver query logs.