【Richtlinien】Überlegungen zur Einführung von AWS CloudTrail in Unternehmensorganisationen/-systemen

📅 Erstellt: 2025/05/05, Aktualisiert: 2025/05/05 ⏱️ Geschätzte Lesezeit ~4 mins (799 Wörter)

AWS CloudTrail ist ein Dienst, der Aktivitäten in Ihrem AWS-Konto überwacht.
Bei der Implementierung von Sicherheitsmaßnahmen in einer Unternehmensorganisation/einem Unternehmenssystem ist der Erhalt von Prüfprotokollen durch die Einführung von AWS CloudTrail unerlässlich.
In diesem Artikel werden die wichtigsten Punkte beschrieben, die Sie bei der Einführung von AWS CloudTrail in Ihrem Unternehmen berücksichtigen sollten.

Inhaltsverzeichnis

What is AWS CloudTrail?
Implementation Considerations
Design Considerations
1. 1. Which events should be collected?
2. 2. Which AWS accounts/regions should collect events?
Related Documents

What is AWS CloudTrail?

AWS CloudTrail (hereafter “CloudTrail”) is a service that records actions taken in your AWS account .
It records three types of events: management events, data events, and insight events.
Management events log API calls that modify AWS resources using the AWS Management Console, AWS SDK, AWS CLI, AWS API, and more.
Data events log activities such as access to objects in S3 buckets and the execution of Lambda functions.
Insight events log findings related to the security and performance of your AWS account.

Implementation Considerations

By default, CloudTrail is enabled when you create an AWS account.
Reference: What is AWS CloudTrail? - AWS CloudTrail
However, a “trail” is not created by default. You can view up to 90 days of events in the AWS Management Console, but since log files are not output, you cannot analyze them with Athena or CloudWatch Logs. If you want to extend the retention period, you need to configure output to an S3 bucket or CloudWatch Logs.
Reference: How CloudTrail Works - AWS CloudTrail
You need to create a CloudTrail trail if any of the following apply:

You need to record management events for more than 90 days
You want to analyze events with Athena or CloudWatch Logs Insights
You need to record data events or insight events

Since it is common to retain audit logs for more than one year, it is strongly recommended to create a trail to record management events.

Design Considerations

1. Which events should be collected?

As mentioned above, CloudTrail can record three types of events: management events, data events, and insight events.
CloudTrail pricing varies depending on the event type. If you configure it to collect all events, costs may increase, so you need to carefully consider which events to collect.
Reference: AWS CloudTrail pricing

Event Name	Price (per 100,000 events)
Management Events *1	2.00 USD
Data Events	0.10 USD
Insight Events *2	0.35 USD

1: The first management event delivered to an S3 bucket is free. From the second management event delivered to an S3 bucket, delivery charges apply.
2: For management and data events, charges apply when delivered to an S3 bucket, while for insight events, charges apply based on the number of analyzed events.

Management Events

It is recommended to collect management events, as they can record user activity history as audit logs.
Although CloudTrail is enabled when you create an AWS account, delivery to S3 buckets or log groups is disabled by default, so you need to create a new trail and enable delivery.

Data Events

Data events can record access to various resources, such as S3 bucket objects and Lambda function executions.
Management events also log APIs that operate on objects, but cannot record access from outside the AWS account. By collecting data events, you can also record access from outside the AWS account.
You can select which resources’ data events to record from the following:
Reference: Logging Data Events with CloudTrail

- AWS::CloudTrail::Channel
- AWS::CodeWhisperer::Customization
- AWS::CodeWhisperer::Profile
- AWS::Cognito::IdentityPool
- AWS::DynamoDB::Stream
- AWS::DynamoDB::Table
- AWS::EC2::Snapshot
- AWS::EMRWAL::Workspace
- AWS::FinSpace::Environment
- AWS::Glue::Table
- AWS::GuardDuty::Detector
- AWS::KendraRanking::ExecutionPlan
- AWS::KinesisVideo::Stream
- AWS::Lambda::Function
- AWS::ManagedBlockchain::Network
- AWS::ManagedBlockchain::Node
- AWS::MedicalImaging::Datastore
- AWS::PCAConnectorAD::Connector
- AWS::S3::AccessPoint
- AWS::S3::Object
- AWS::S3ObjectLambda::AccessPoint
- AWS::S3Outposts::Object
- AWS::SageMaker::Endpoint
- AWS::SageMaker::ExperimentTrialComponent
- AWS::SageMaker::FeatureGroup
- AWS::SNS::PlatformEndpoint
- AWS::SNS::Topic
- AWS::SSMMessages::ControlChannel
- AWS::Timestream::Database
- AWS::Timestream::Table
- AWS::VerifiedPermissions::PolicyStore

The purpose of recording varies depending on the resource, so select as needed.
For example, by recording data events for S3 buckets, you can obtain a change history of objects in the bucket.
Note that while data events guarantee completeness, S3 server access logs do not.
Reference: How to deal with missing access logs in S3 server access logs | DevelopersIO
On the other hand, server access logs are sometimes used for buckets that output Config or CloudTrail logs created by Control Tower, and AWS Foundational Security Best Practices recommends outputting server access logs.
Reference: AWS Foundational Security Best Practices v1.0.0 (FSBP) standard - AWS Security Hub
The lack of guaranteed completeness may be a concern, but since data events can be costly, it may be an option to accept the lack of completeness and use server access logs.

Insight Events

Insight events use machine learning to analyze management events and detect abnormal activities when behavior deviates from the norm.
Write events detect abnormal activity when there are many API calls.
Write/Read events detect abnormal activity when the API error rate is high.
Main reasons for detecting abnormal activity include:
Malicious API access
Application bugs
Access denied due to permission misconfiguration, such as IAM roles or SCPs
Since insight events are more expensive than other events, you should carefully consider enabling them.
As mentioned above, if you frequently make changes to your system in a production environment, insight events may be generated, so consider enabling them as needed.

2. Which AWS accounts/regions should collect events?

Since CloudTrail is often required as an audit log, it is generally recommended to create trails for all available AWS accounts.
However, you may choose not to create trails for accounts with limited regions due to SCPs or for management accounts where changes are infrequent.

What Is AWS CloudTrail? - AWS CloudTrail