CloudTrail Insights and Log File Integrity

CloudTrail Insights is an optional feature that uses machine learning to automatically detect unusual API activity in your AWS account. It establishes a baseline of normal API call rates and write management event volumes for each API, then alerts you when activity deviates significantly from that baseline. Insights events are delivered to the same S3 bucket as your trail logs and can also trigger EventBridge rules for automated response.

CloudTrail Insights is enabled per trail. You can choose to detect API call rate anomalies (unusual number of write management events per second) or API error rate anomalies (unusual number of access-denied or throttling errors). Insights requires an active trail with management events enabled. AWS charges for Insights events in addition to regular trail event charges. Insights takes 24-36 hours to establish an initial baseline before it can start detecting anomalies.

An Insights event has a start event and an end event. The start event fires when the anomaly begins — for example, an unusual spike in TerminateInstances calls — and the end event fires when the API call rate returns to normal. Each Insights event includes the affected API, the normal baseline rate, the observed peak rate, and the duration. This helps you understand whether an anomaly was a sustained attack or a brief burst.

Common anomalies CloudTrail Insights flags: a credential compromise where an attacker uses stolen keys to enumerate all S3 buckets at high speed, a misconfigured deployment script that loops and calls the EC2 API thousands of times, an insider threat deleting resources faster than normal, or a supply chain attack where a Lambda function suddenly makes unusual STS calls. Insights gives you a faster detection window than manually reviewing CloudTrail logs.

CloudTrail Insights events are automatically delivered to Amazon EventBridge, enabling automated response. You can create an EventBridge rule that triggers a Lambda function when an Insights event is detected — for example, to send a Slack message, create a Jira ticket, or even automatically revoke the IAM user's access keys if the anomaly matches a known attack pattern. This creates a real-time security automation pipeline around Insights findings.

Log file integrity validation ensures that CloudTrail log files have not been modified, deleted, or forged after delivery to S3. When enabled (via --enable-log-file-validation), CloudTrail creates a digest file every hour that contains the SHA-256 hashes of all log files delivered during that hour, plus the hash of the previous digest. The digest file itself is signed with CloudTrail's private key. You can validate logs using the AWS CLI's validate-logs command.

Every hour, CloudTrail delivers a digest file to S3 at a path separate from log files (s3://bucket/CloudTrail-Digest/...). The digest contains the SHA-256 hash of each log file delivered in the past hour, the S3 URI of each file, and a hash of the previous digest (creating a hash chain). If an attacker modifies a log file after delivery, the hash in the digest will no longer match — validation will fail and report which files were tampered with.

Log file integrity is only useful if the digest files and log files themselves are protected. Best practices: enable S3 MFA Delete on the CloudTrail bucket so files cannot be deleted without MFA, apply a deny-delete bucket policy to prevent any principal from deleting objects, enable S3 Object Lock (Compliance mode) for immutable log retention, and use an organisation trail so member accounts cannot disable logging. These controls together make it nearly impossible for an insider to erase audit evidence.

CloudTrail Insights and Amazon GuardDuty are complementary, not duplicates. Insights focuses on API call volume anomalies — sudden spikes in specific management API calls. GuardDuty analyses a broader set of data sources including CloudTrail events, VPC Flow Logs, and DNS logs to detect threat patterns such as compromised credentials, crypto mining, data exfiltration, and known malicious IPs. For defence-in-depth, enable both — Insights for volume-based anomalies, GuardDuty for threat-intelligence-based detections.

In the CloudTrail console, the Insights tab lists all detected anomalies with their start and end times, the API name, and a graph comparing the baseline rate vs the observed rate during the anomaly. Clicking on an Insights event links directly to the related management events in Event History for the same time window, helping you correlate 'there was an anomaly' with 'here are the specific API calls that caused it.' This drill-down capability is what makes Insights actionable.

Log file integrity validation is required by multiple compliance frameworks: PCI-DSS requires proof that audit logs have not been altered; HIPAA mandates tamper-evident audit controls for healthcare data; SOC 2 requires integrity controls over security logs. The combination of CloudTrail log file validation + S3 Object Lock + organisation trails satisfies these requirements and is commonly cited in AWS compliance documentation. When exam questions mention 'prove logs were not tampered with', log file integrity validation is the answer.

Test your understanding of AWS Solutions Architect (SAA-C03) concepts from this lesson.

In this lesson you learned: CloudTrail Insights uses ML to detect unusual API call rate and error rate anomalies with start/end events, log file integrity validation uses SHA-256 digest files in a hash chain to detect any tampering or deletion of log files, and S3 Object Lock combined with deny-delete policies protects the integrity of the audit trail. Next up we explore AWS Config Rules and automated remediation.