Glossary
CloudTrail event history
The built-in, per-region record of the last 90 days of CloudTrail management events, available in every AWS account without any trail configured.
CloudTrail event history is available in every AWS account by default. It
holds the last 90 days of management events, per region, and can be
searched in the console or with aws cloudtrail lookup-events, one
attribute filter at a time. Downloads are JSON or CSV.
It does not contain data events
(such as S3 GetObject) or Insights events, and it is independent of
trails: stopping or deleting a trail does not remove it. That makes it the
fallback when no trail existed or when an attacker disabled logging — see
how to export logs for an investigation.
Reference: Working with CloudTrail event history.