Skip to content

This tool is not affiliated with, endorsed by or sponsored by Amazon Web Services, Inc. or Amazon.com, Inc. AWS, Amazon Web Services, CloudTrail and GuardDuty are trademarks of Amazon.com, Inc. or its affiliates. Other names are trademarks of their respective owners.

Glossary

CloudTrail event history

The built-in, per-region record of the last 90 days of CloudTrail management events, available in every AWS account without any trail configured.

CloudTrail event history is available in every AWS account by default. It holds the last 90 days of management events, per region, and can be searched in the console or with aws cloudtrail lookup-events, one attribute filter at a time. Downloads are JSON or CSV.

It does not contain data events (such as S3 GetObject) or Insights events, and it is independent of trails: stopping or deleting a trail does not remove it. That makes it the fallback when no trail existed or when an attacker disabled logging — see how to export logs for an investigation.

Reference: Working with CloudTrail event history.

This tool is not affiliated with, endorsed by or sponsored by Amazon Web Services, Inc. or Amazon.com, Inc. AWS, Amazon Web Services, CloudTrail and GuardDuty are trademarks of Amazon.com, Inc. or its affiliates. Other names are trademarks of their respective owners.