Okay, so let's learn about CloudTrail.
So let's open the CloudTrail Service
and we're going to look at API activity
within their accounts so let me close these things.
And let's go on the left hand side
and let's go to the dashboard.
So currently the dashboard shows that
we have no trails created
and that we haven't enabled the CloudTrail insights.
And we can look at the event history
of everything that happened within my accounts recently.
So if I go to event history here I get all the information
of all the API calls made by some services
and when it happens and what was the username
and the event sources and stuff like this.
So it's quite interesting because we can look at
read only events or we can look at write events.
So like this is read only false
so that means these are all the write events
such as delete role, delete policy, these kind of things.
If we look at terminate instances for example,
so I'm going to look at events name is terminates instances.
Okay so this is a filter.
We can see when instances were being deleted in EC2
and so you can see these two instances right here
were deleted by roots so this is me.
One was deleted by the cloud nine service
so when I was using cloud nine and one by auto-scaling.
And if we want to drill down into an event for example
we can look at this event right here.
Okay so an instance was terminated on this date.
And if I scroll down I get an information
around the event records so all the information around
when it happened, the region it happened from, the IP,
the request parameters,
all these kinds of things that allow me
if I go back to it to really understand who initiated it
and what, and when and how okay?
So this is some really good information.
And then it also links to the resource being referenced
which it says this EC2 instance was trying to be deleted.
Obviously, if I click on this resource name
it's not going to take me anywhere
because this instance was terminated
and so it's not going to find any kind of instances.
But you can see the usefulness of this event right here.
Okay?
So these are for, you can filter by events as we can see
if there was a read only, and you just say true
then you're going to get all the type of events
that just read.
For example describe instances is an event
that doesn't changed anything.
And so you get the idea around how CloudTrail works.
As we can see event history shows you
the last 90 days of event managements.
And there is a problem if we want to have more than that
but we'll see how we can fix this okay?
So insights is not enabled.
And if you create a trail with insights in it
you gonna have to pay for it so I'm not going to do this
but I will show you how we can enable it.
And trails is how you would create a trail
to capture more events.
So let's click on create a trail and see how things work.
So I call it demo trail.
And as we can see, we could enable this
for multiple accounts if we had an organization
so that you can manage everything directly
from the collateral service.
And where do we want to send these logs?
So do we want to send everything in a new bucket
or an existing bucket?
So yes, I can create a new buckets
that will be created automatically to have this trail.
Do we want this bucket to be encrypted? So sure why not?
No. I'll disable. This is going to be easier.
Log file validation sure I'll enable it.
And SMS notification delivery I don't need it.
Next we can also send these logs into CloudWatch logs.
So I can enable this and create a new log group
which is going to have this name.
So that means that in CloudWatch logs, as well as an S3
I'm going to have all the information
around all these events happening within CloudTrail.
Do we want to create a new role for this?
Yes, let's create a new role
and it will be created automatically.
So I'll call it a CloudTrail role for demo. Okay.
Next we can tag it and I don't need it
so I don't need to tag this trail.
Next with team we need to choose a type of log events
that we want to log into CloudWatch and S3
and this kind of things.
So management events as we've seen is all the events
that are happening on your AWS resources.
So whenever we terminate an instance,
whenever we create a new IM role these kind of things.
But data events is going to be
for events happening on your S3 buckets
and render functions.
And insights events if you want to enable cloud insights
to detect unusual activity errors
or user behavior in our accounts and you have to pay
for both of these things if you enable it.
I just wanna show you the options right now in the console.
So if for management events, what do we want to have?
Do we want to have read events, write events
and do you want to exclude KMS events
because encryption happens a lot
and sometimes you just don't wanna see it.
So we can click on this
and you don't get any additional charges
because management events are free.
Next for data events.
This is the data sources you need to choose
so we have S3 or Lambda right now in terms of data events.
So if you choose S3
what do we want to log in terms of data events?
So do we want to log all current and future S3 buckets
for read and write actions?
So put objects, read objects, get object
this kind of things.
Or do we want to have individual bucket selection
and what do we want to have for logging for read and writes?
So it's up to you to define as many types of S3 buckets
as you want or just all of them okay?
And then if you want to have Lambda and S3
you can just add a new data events type
and have Lambda and then choose all functions
and this is going to log all data events
around all these functions
or you can just input the function name if you want it to.
So pretty handy.
And then for insights events
it's just one nub here to enable.
And then it says, okay, insights is enabled.
And so usage anomalies are going to be logged
and you can view them.
Because I don't want to make you go
out of the free trial here
I'm just going to unselect data events and insight events
but at least you've seen the option
and you've seen the use cases.
So I click on next and it will create this trail.
Okay so my trail has now been created.
If I click on it I'm able to see where it's going to go to
so this is, I believe my S3 buckets that it is logging to.
And this also goes into a CloudWatch logs group right here
so I need to go into services and go to CloudWatch
and I'm going to find CloudWatch logs so let's open this.
And here is logs and I go to log groups
and here I can see my CloudTrail logs right here
that I have.
So there's a log stream that was created as well
and this is where the events would happen.
So my S3 buckets contains the CloudTrail
and CloudTrail digest.
So if I click on CloudTrail
this is where the objects would appear as well.
So let me close this screen.
So what I'm going to do is just wait a little bit
for CloudTrail to start sending some data into S3
and CloudWatch.
That could take five minutes
and we can do to have fun as you can, for example
open a service in EC2.
And for example I'm going to create a key pair just for fun
so we can have a look at it.
So I'm going to do funky pair
and we'll try to find that events
in at least CloudWatch or at least CloudWatch logs.
Okay so fun keeper has been created.
Now, let me wait a little bit and I will get back to you.
Okay so I'm going to refresh my log events
and as we can see, a lot of events have been logged
by CloudTrail already into my CloudWatch logs.
If I want to filter it for the API called name
creates key pair and press enter.
It's not being found.
Let's go try to find it first into CloudTrail
to see if it appears there.
So let's go to the event history, and I'm going to look
by event name and it's going to be creates key pair
which was logged right here.
So we can see this create key pair happening right here
and it was done
and we can even see the name of the key pair.
Oh, this was my old key pair so this was my dummy keeper
so we need to wait a little bit
to get my fun key pair to appear here.
So let's wait because CloudTrail can take
up to five minutes, up to 15 minutes sometimes
to make events appear so let's wait a little bit.
So let's refresh our event history.
So now we see two key pairs so perfect.
The event was being delivered into CloudTrail.
So that means that if I go to CloudWatch
and search again for my events, yes I can see four events
related to my creates key pair.
So if we look at the events
this is when it was created and so on.
So this is quite cool.
So we can look at all these events
related to my creates key pair.
And if I go into my S3 buckets and refresh my objects
as we can see, we get a cloud trail directory in history
for each region that we're in.
So we're in EUS1 and then we can look by dates
and here we go.
We have some files that here I can download
and open up and it will give me adjacent files okay
that I can,
that will look exactly the same as what's in here
and what's in CloudTrail if I click on one of these events
it will look at the same event record okay?
But the cool thing is that because it is an Amazon S3
then we can use Athena to query these records.
So if I go into CloudTrail and look into the event history
I can create an Athena table
and choose my CloudTrail logs here.
And this is going to create a table
in Athena and this table in Athena that I can open up
I will show you right here is going to allow me
to query for historical events in CloudTrail.
So if I look at this table and then I will look on,
click on the three dots and say preview table.
So let's run this query
and there's no output location defined.
So let me just scroll up,
click on set up a queries at location
and I need to just select a bucket for this.
So I can select this one.
This looks right and press select, click on save. Perfect.
So now if I run this query again, this should work.
Here we go.
And we can see the results where we have the event version
the user identity and with a bunch of columns into Athena
so the event time, the event source, event name,
region, source IP address, user agent, and so on.
And we can start running some queries
around these events and analyze our data historically
which I think is really, really cool.
So that's it for this lecture.
I hope you liked it and if you wanted to
just clean up after yourself
you could delete these extra buckets.
You could delete this CloudTrail log group
and I'm going to do this right now in the trail itself.
I can click on it and delete this trail
so it stops logging stuff all around.
So that's it.
I hope you liked it and I will see you in the next lecture.