In this video, you’ll see how to modernize your audit log management using AWS CloudTrail Lake.
With this platform, you can create a managed immutable data lake of CloudTrail audit logs,
simplify CloudTrail analysis workflows, and optimize your logs for analysis and query.
To get started, let’s navigate to CloudTrail Lake.
CloudTrail Lake integrates collection, storage, preparation, and optimization
for analysis and query in the same product.
This removes the need to maintain separate data processing pipelines that span across teams
and products to analyze CloudTrail events.
The first thing we’ll need to do is create an event data store.
Let’s specify a name for our new event data store.
By default, event data is retained for the maximum period of seven years, or 2,555 days.
We'll retain the default.
Let’s collect information for all accounts in our organization.
We also have the option to add tags.
In this case, let’s just move on.
Here we can specify which events we want to collect.
Let’s choose to collect both management events and data events.
Next, we’ll need to specify the type of data event we want to log.
For this example, we’ll select Amazon Simple Storage Service (Amazon S3).
Next, we’ll specify a log selector template.
We can customize the types of events we want to collect.
In this case, we’ll log events for the DeleteObject operation.
We could then go further and specify that we only want to
collect these DeleteObject events for a specific S3 bucket.
However, for the purposes of this example,
let’s go back and specify that we’re only logging management events.
Let’s review the configuration and create the event data store.
Once the event data store has been created, CloudTrail Lake will begin recording all events
defined or specified during the creation process, and we’ll be able to query them.
For now, we’ll query an existing event data store.
Let’s take a look at some sample queries we can use.
Let’s select this first query,
which finds all principal IDs who called a particular API in a given date range.
On the left, we can see which event data store will be queried.
In the editor, we can modify the SQL query as needed to get the information we’re looking for.
Let’s modify the date range.
We’ll also change the API operation to StartAutomationExecution.
Let’s run the query.
As you can see, 200 records matched our query.
Let’s expand the “Response” section to see more.
Notice that nearly 780,000 records were scanned,
or about 550 megabytes within 6.7 seconds,
which is approximately 81.8 megabytes per second.
Let’s take look at the query results.
Here are the principal IDs that invoked the StartAutomationExecution API
within the date range that we specified.
Let’s try another sample query.
We’ll select this query, which finds the number of API calls that were
grouped by event name and event source within a given date range.
Let’s make sure we’re querying the preexisting event data store, not the one we just created.
Next, we’ll modify the date range and run the query.
Let’s check the command output.
We’ll expand the “Response” section again to see how
quickly CloudTrail Lake was able to query the information.
In this case, it scanned over 800,000 records in 3.3 seconds.
Let’s view the query results.
Right away, we can see that the S3 API call PutObject was called more than 150,000
times within the date range we specified.
Now let’s create our own query.
We’ll look for all S3 presigned URLs that have been created within a given time range.
Forty-three records matched.
Let’s look at the results.
Here we can review who created these S3 presigned URLs.
Let’s save this query so we can reuse it in the future.
We’ll simply enter a name and description, and then save the query.
Now we can find our query in the Saved queries tab.
We can select our query and run it again, as necessary.
But if we just want to get the results from a recently performed query, we can go to the Results history tab.
Here we can see all of the queries that were performed within the last seven days.
Let’s reopen the most recent one.
Here are the query results we were reviewing previously.
You’ve just seen how to modernize your audit log management using AWS CloudTrail Lake.
You can learn more about this topic in the description and links for this video.
Thanks for watching. Now it's your turn to try.