Freedom251 › Log Management Software
AWS CloudTrail
What AWS CloudTrail is
AWS CloudTrail records user activity and API calls across AWS services for auditing, security monitoring and operational troubleshooting. It captures management, data, network-activity and Insights events. Every AWS account has a searchable, downloadable and immutable history of management events covering the previous 90 days in each AWS Region. Trails deliver events to Amazon S3, with optional delivery to CloudWatch Logs and Amazon EventBridge; Amazon Athena can analyze the logs. AWS Organizations enables collection across multiple accounts. CloudTrail can validate whether delivered files changed or were deleted, while S3 uses server-side encryption by default and supports AWS KMS encryption. Data-event aggregation creates five-minute summaries with activity trends. CloudTrail Lake adds SQL queries, AI-assisted natural-language query generation and event consolidation from other cloud providers, applications and SaaS services. Query-result summaries are in preview. Lake will stop accepting new customers starting May 31, 2026, with AWS pointing to Amazon CloudWatch for similar capabilities. CloudTrail is cloud-deployed and available through web and API.
Who it suits
CloudTrail suits AWS administrators, IT auditors, security administrators and DevOps engineers handling audit, policy and troubleshooting work. It also supports organizations needing centralized events across accounts or sources.
What it does well
- Includes 90 days of event history
- Delivers trails to Amazon S3
- Supports multi-account collection
- Validates log-file integrity
- Offers SQL and natural-language Lake queries
What to know first
- CloudTrail Lake closes to new customers May 31, 2026
- Lake query-result summaries are in preview
- Additional event delivery carries charges
- No live log tailing
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Event history | 90-day management event history · view, search, and download | Free |
| Trail management events | The first copy of management events is free · Deliver additional copies of management events to Amazon S3 | $2 a month |
| Trail data events | Deliver data events to Amazon S3 | $0.10 a month |
| Trail data event aggregation | Charged in addition to data event charges · Deliver five-minute summaries of data events | $0.03 a month |
| Trail network activity events | Deliver network activity events to Amazon S3 | $0.10 a month |
| CloudWatch Logs delivery | CloudWatch Logs ingestion fees also apply · Deliver management and data events to a CloudWatch Logs group | $0.25 a month |
| CloudTrail Lake one-year extendable retention | For CloudTrail management, data, and network activity events · 366 days default retention · 3,653 days maximum retention | $0.75 a month |
| CloudTrail Lake seven-year retention | First 5 TB per month; tiered rates apply above 5 TB · 2,557 days retention | $2.50 a month |
The first 8 of 10 plans, as aws.amazon.com lists them, read 7 Oct 2026. The maker's own page has the final word. Every plan
Verdict
CloudTrail provides AWS activity records, durable trail delivery and integrity controls, with pricing options for different event types and retention. Its Lake capabilities are broad, but the stated 2026 intake cutoff matters to new adopters.
Facts from AWS CloudTrail's own pages
- Archive export
- Yes · aws.amazon.com, 20 Sept 2026
- AWS support
- The CloudTrail page links to AWS support options and expert assistance for getting started. · aws.amazon.com, 7 Oct 2026
- CloudTrail Lake
- CloudTrail Lake supports SQL queries, AI-powered natural-language query generation, and query-result summaries currently marked as in preview. · aws.amazon.com, 7 Oct 2026
- Compliance use
- AWS says CloudTrail logs can help demonstrate compliance with regulations such as SOC, PCI, and HIPAA. · aws.amazon.com, 7 Oct 2026
- Deployment options
- cloud · aws.amazon.com, 20 Sept 2026
- Event aggregation
- Data event aggregation consolidates events into five-minute summaries with trends such as access frequency, error rates, and most-used actions. · aws.amazon.com, 7 Oct 2026
- Event history
- Event history is enabled on all AWS accounts and provides a searchable, downloadable, immutable record of the past 90 days of management events in an AWS Region. · aws.amazon.com, 7 Oct 2026
- Event types
- CloudTrail records management, data, network activity, and Insights events. · aws.amazon.com, 7 Oct 2026
- Free plan
- Yes · aws.amazon.com, 20 Sept 2026
- Intended users
- AWS describes CloudTrail Lake as useful for IT auditors, security administrators, and DevOps engineers handling audit requirements, policy checks, and operational troubleshooting. · aws.amazon.com, 7 Oct 2026
- Lake availability limit
- CloudTrail Lake will no longer be open to new customers starting May 31, 2026; AWS points to Amazon CloudWatch for similar capabilities. · aws.amazon.com, 7 Oct 2026
- Live log tailing
- No · aws.amazon.com, 20 Sept 2026
- Log integrity and encryption
- CloudTrail can validate whether delivered log files were changed or deleted, and encrypts files in S3 by default with server-side encryption, with AWS KMS encryption available as an additional option. · aws.amazon.com, 7 Oct 2026
- Log pipelines
- No · aws.amazon.com, 20 Sept 2026
- Multi-account
- Trails can capture and store events from multiple AWS accounts using AWS Organizations. · aws.amazon.com, 7 Oct 2026
- Non-AWS sources
- CloudTrail Lake can consolidate events from other cloud providers, in-house applications, and SaaS applications running in the cloud or on premises. · aws.amazon.com, 7 Oct 2026
- Purpose
- CloudTrail tracks user activity and API calls across AWS services for auditing, security monitoring, and operational troubleshooting. · aws.amazon.com, 7 Oct 2026
- Structured log parsing
- Yes · aws.amazon.com, 20 Sept 2026
- Trails and integrations
- Trails deliver activity events to Amazon S3, with optional delivery to CloudWatch Logs and Amazon EventBridge, and logs can be analyzed with Amazon Athena. · aws.amazon.com, 7 Oct 2026
Where AWS CloudTrail stands on Freedom251
- Log Management Software#65 of 111