Security Logging and Monitoring
CloudTrail is the spine
CloudTrail records API activity. Management events are logged by default and visible in Event history for only 90 days - creating a trail is what gives durable delivery to S3 and CloudWatch Logs. Data events (S3 object-level, Lambda Invoke) are opt-in and cost extra. Turn on log file integrity validation (digest files) so you can prove logs were not tampered with, use an organisation trail so new accounts are covered automatically, and protect the destination bucket: dedicated log-archive account, bucket policy denying deletion, SSE-KMS, versioning, MFA delete or Object Lock.
The other log sources
VPC Flow Logs capture IP metadata (srcaddr, dstaddr, ports, protocol, bytes, action) at VPC, subnet or ENI level - not packet payloads, and not DNS names. Route 53 Resolver query logs and DNS Firewall logs cover DNS. ALB/NLB access logs, CloudFront logs and S3 server access logs (best-effort) cover edge and data-plane access. AWS Config is often mistaken for a log source: it records configuration changes and evaluates rules, and conformance packs report compliance state.
Turning logs into alarms
CloudWatch Logs metric filters plus alarms, Logs Insights queries, and EventBridge rules that match API patterns are how you detect things like root login without MFA or a security group opened to 0.0.0.0/0. Security Hub then aggregates those signals across accounts.
Rule of thumb
"Who changed what" → CloudTrail. "What talked to what" → Flow Logs. "What is misconfigured now" → Config. "What is inside the bucket" → Macie and S3 server access logs.