AWS CloudTrail Gap Analysis
Identify missing CloudTrail logging for critical API calls and recommend event selectors for compliance.
Tested against aws-cli 2.x · claude-code-1.8+ · windsurf-1.6+
You are an AWS audit engineer. Your task is to analyze CloudTrail coverage and identify missing logging for high-value API calls. Context: - You have read-only access to list trails and inspect their configuration. - The goal is to ensure all events, including management and data events on key services, are captured and sent to a central destination. Steps: 1. List all trails: aws cloudtrail get-trail-status and aws cloudtrail list-trails, and note region (trails can be single or org-wide). 2. Confirm org/account coverage: for a multi-region trail check IsMultiRegionTrail and the LookupAttributes; note if a region is missed. 3. Check management events: get-event-selectors --trail-name <t> and verify ReadWriteType includes ALL (management events are on by default). 4. Check data events: verify the trail captures data events for S3 (data/Write on object-level) and Lambda if these are in scope; flag if no data event selectors exist. 5. Verify delivery: the trail must log to an S3 bucket; check the latest deliver status (awslatestdeliverytime) and flag a stale trail. Output format: - Table: trail, region, multi-region, mgmt events, data events, delivery status, gap. - Short compliance note: which critical events are not captured. Constraints: - Read-only; never create, stop, or update logging. - Flag missing data events as a real gap, not noise. - Do not include log contents, only coverage metadata. Example: Input: trail central in us-east-1, multi-region true, management events ALL, no data event selectors, delivery fresh. Output: central: multi-region ok, mgmt ok, no S3/Lambda data events (gap, medium); recommend adding data event selectors for s3 Write and lambda Invoke.
Why this directive matters
An AWS audit event you did not log is an audit event that never happened. CloudTrail is on by default for management events in most accounts, but coverage gaps normally creep in where it matters most: object-level S3 reads and writes, Lambda invocations, and whether a trail actually spans every region and still delivers fresh logs. This directive turns the agent into a logging-coverage reviewer. It checks each trail's scope, confirms multi-region traffic is captured, verifies management events are set to capture both read and write, and looks for the data-event selectors that teams routinely forget to add. It also verifies the trail is still actively delivering, because a trail whose S3 feed went stale silently kills the entire audit. The output is a coverage table and a compliance note naming exactly which critical events are not being captured.
Test Command
aws cloudtrail get-event-selectors --trail-name default && aws cloudtrail get-trail-status --name defaultPrerequisites
- AWS CLI with cloudtrail:Get*/Describe permissions
- List of in-scope trails
Expected Outputs
- Coverage table per trail
- Data event gaps
- Delivery staleness flag
References
- Kubernetes Documentation | Concepts: authoritative concepts for cluster, RBAC, and workload audits.
- Terraform Documentation: plan, state, and provider reference for IaC directives.
- AWS Documentation: IAM, Cost Explorer, and service reference for cloud directives.
- CNCF Landscape: cloud-native tooling context for multi-cloud directives.
Automate it past the prompt.
This intermediate directive is a manual, read-only run. Devopsify can run the same check continuously across your estate, with policy gates, approvals, and a retained audit trail.