Glossary
CloudTrail
The AWS service that records API calls and console sign-ins in an account as JSON events — the primary evidence source in almost every AWS investigation.
AWS CloudTrail records the API calls made in an AWS account — from the
console, the CLI, SDKs and AWS services acting on your behalf — as JSON
events with who (userIdentity), what (eventSource, eventName), when
(eventTime), from where (sourceIPAddress, userAgent) and the outcome
(errorCode).
Every account gets 90 days of management events in event history. A trail delivers events to an S3 bucket for as long as you keep them, and can also record data events.
In an incident, CloudTrail answers "which credential did what, from where": see CloudTrail events every responder should know and the step-by-step analysis guide. Reference: AWS CloudTrail documentation.