网络课程笔记

Lecture 256: AWS CloudTrail

• 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
• 视频时长：05:30
• 来源：Udemy Lecture 33789974
• Slide 数量：5
• 画面切换：00:40、01:45、02:24、03:39

扫描说明

逐条读取了 Transcript 面板中的 131 条英文 cue，并按播放器进度同步全长约 5:30 的视频。依据 Management Service Boundary、Event History、Regional/Global Scope、Trail Destination/Analytics 与 Event Anatomy/Security Operations 划分为 5 个小节。5 张截图来自真实课程 Slide，统一为 1364×770。讲义纠正了两个常见简化：Event History 默认保留的是近 90 天 Management Events，而非所有 Event；CloudTrail 交付到 S3 的记录是压缩 JSON，不要求先转成 CSV 才能用 Athena 查询。

Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。

1. CloudFormation 负责 Build，Config 负责 State/Compliance，CloudTrail 负责 API/Event Audit

时间范围：00:00–00:40

总结 / Summary

中文

管理服务按问题拆分：CloudFormation/Service Catalog 创建受控 Infrastructure；AWS Config 记录 Resource Configuration 与 Compliance；AWS CloudTrail 记录 AWS Account/Organization 中受支持的 API Activity 与 Service Event。CloudTrail 回答 Who、When、Where、What action、Against which resource，以及 Success/Error。它是 Control-plane Forensics 的基础，但不记录 Network Packet/Flow；Traffic Analysis 仍需 VPC Flow Logs、ELB Logs、DNS Logs 等数据源。

English

Management services answer different questions: CloudFormation and Service Catalog build governed infrastructure, AWS Config records resource configuration and compliance, and AWS CloudTrail records supported API activity and service events in an AWS account or organization. CloudTrail answers who, when, where, what action, against which resource, and whether it succeeded or failed. It is foundational for control-plane forensics, but it does not record network packets or flows; traffic analysis still requires VPC Flow Logs, load-balancer logs, DNS logs, and similar sources.

2. Event History 默认提供近 90 天 Management Event；长期留存需 Trail 或 Event Data Store

时间范围：00:40–01:45

总结 / Summary

中文

CloudTrail Event History 无需先创建 Trail，即可按 Region 查看近 90 天的 Management Events，例如 Console、CLI、SDK 或 AWS Service 发起的 CreateVpc、ModifyRoute、AuthorizeSecurityGroupIngress、TerminateInstances。这里不能简化为“所有 API Call”：S3 Object-level、Lambda Invocation 等 Data Event 通常需要在 Event Selector 中显式启用，覆盖范围与费用不同。需要长期、集中或可查询留存时，创建 Trail 交付至 S3/CloudWatch Logs，或使用 CloudTrail Lake Event Data Store。

English

CloudTrail Event History works without first creating a trail and provides the last 90 days of regional management events, such as CreateVpc, ModifyRoute, AuthorizeSecurityGroupIngress, or TerminateInstances initiated through the console, CLI, SDK, or an AWS service. Do not simplify this to every API call: data events such as S3 object access or Lambda invocation generally require explicit event selectors and have different coverage and cost. For long-term, centralized, or queryable retention, create a trail that delivers to S3 or CloudWatch Logs, or use a CloudTrail Lake event data store.

3. Trail 可覆盖单 Region 或所有 Region，并纳入 Global Service Event

时间范围：01:45–02:24

总结 / Summary

中文

Trail 是 Event Delivery Configuration，不是 Event 本身。Multi-region Trail 自动把所有已启用 Region 的 Event 送往同一 Destination，并可包含 IAM、STS 等 Global Service Event；组织环境优先使用 Organization Trail 统一覆盖成员账号。Event History 仍按 Region 查看，Global Service Event 的记录/交付有特殊 Region 语义，因此排查 IAM 变更时应确认查询 Region 与 Trail Setting，而不是假设每个 Region 都有一份相同副本。

English

A trail is an event-delivery configuration, not the event itself. A multi-region trail sends events from all enabled regions to one destination and can include global-service events such as IAM or STS activity; organizations can use an organization trail for consistent member-account coverage. Event History remains regional, and global-service events have special regional recording and delivery semantics. When investigating IAM changes, verify the query region and trail settings rather than assuming identical copies exist in every region.

4. Central S3/CloudWatch Logs Pipeline 支撑 Athena、OpenSearch、SIEM 与 Alarm

时间范围：02:24–03:39

总结 / Summary

中文

Central Trail/Organization Trail 可把多 Account/Region Event 交付到安全日志账号的 S3 Bucket，并可选发送到 CloudWatch Logs。S3 中的 CloudTrail Log File 是 GZIP 压缩 JSON；Athena 通过 Schema/Table 直接查询这些 JSON，并不要求 CSV。CloudWatch Logs Metric Filter/Alarm 可检测敏感 API，EventBridge Rule 可近实时触发响应；S3 数据也可进入 OpenSearch 或 SIEM。生产环境应启用 KMS Encryption、Log File Validation、严格 Bucket Policy/Access、Retention 与防篡改控制。

English

A central or organization trail can deliver multi-account and multi-region events to an S3 bucket in a security logging account and optionally to CloudWatch Logs. CloudTrail log files in S3 are GZIP-compressed JSON; Athena queries them through a schema and table without requiring CSV. CloudWatch Logs metric filters and alarms can detect sensitive APIs, while EventBridge rules can trigger near-real-time responses; S3 data can also feed OpenSearch or a SIEM. Production designs should use KMS encryption, log-file validation, strict bucket access, retention, and anti-tampering controls.

5. Event JSON 用 userIdentity、eventTime、eventSource/eventName 与 requestParameters 还原动作

时间范围：03:39–05:30

总结 / Summary

中文

调查时先看 userIdentity（IAM User、AssumedRole、AWS Service 等）、eventTime、eventSource、eventName、awsRegion、sourceIPAddress 与 userAgent，再检查 requestParameters、responseElements、resources、errorCode/errorMessage。网络事件如 CreateVpc、CreateRoute、ReplaceRoute、AttachInternetGateway、AssociateRouteTable、AuthorizeSecurityGroupIngress 都能据此还原 Control-plane 变化。跨账号场景还需查看 recipientAccountId、sessionContext 与 Role Session。CloudTrail 能证明 API Event，不代表请求一定导致预期 Data-plane Effect；应再与 Config Timeline、Flow Logs 和资源状态关联。

English

Start an investigation with userIdentity, including IAM user, assumed role, or AWS service, then eventTime, eventSource, eventName, awsRegion, sourceIPAddress, and userAgent. Continue with requestParameters, responseElements, resources, errorCode, and errorMessage. Network events such as CreateVpc, CreateRoute, ReplaceRoute, AttachInternetGateway, AssociateRouteTable, and AuthorizeSecurityGroupIngress reconstruct control-plane changes. Cross-account cases also require recipientAccountId, sessionContext, and role-session details. CloudTrail proves an API event occurred; it does not prove the intended data-plane effect, so correlate it with Config timelines, flow logs, and current resource state.

整讲总结 / Overall Summary

中文

CloudTrail 的考试主线是 Event History、Trail/Organization Trail、Management vs Data Event、Regional/Global Scope、S3/CloudWatch Logs Destination 与 Event JSON Forensics。看到“谁删除了资源、谁改了 Route/Security Group、调用来自哪里”选 CloudTrail；看到“资源配置如何变化/是否合规”选 Config；看到“包是否到达”则选 Flow Logs 或其他 Data-plane Telemetry。

English

CloudTrail exam priorities are Event History, trails and organization trails, management versus data events, regional and global scope, S3 or CloudWatch Logs destinations, and event JSON forensics. Choose CloudTrail for who deleted a resource, who changed a route or security group, and where the call originated; choose Config for how configuration changed or whether it is compliant; choose flow logs or other data-plane telemetry for whether packets arrived.