When something changes unexpectedly in an AWS account, the first question is always the same: who did this, and when? Without CloudTrail and Config enabled, that question often has no answer. With them, it takes minutes to find.
AWS CloudTrail — The Record of Every Action
CloudTrail logs every API call made in your AWS account, whether it came from the console, CLI, SDK, or another AWS service.
- Records who made a change, what the change was, and when it happened
- Covers actions across virtually every AWS service in the account
- Logs can be sent to S3 for long-term storage and to CloudWatch for real-time alerting
- Essential for investigating security incidents and satisfying most compliance frameworks
AWS Config — The State of Your Resources Over Time
Where CloudTrail tells you what action was taken, Config tells you what your resources actually looked like before and after — and whether they match your defined rules.
- Continuously records configuration changes to resources like security groups, S3 buckets, and IAM policies
- Evaluates resources against Config Rules — for example, flagging any S3 bucket that becomes publicly accessible
- Maintains a full history, so you can see exactly how a resource’s configuration evolved over time
- Can trigger automated remediation when a resource drifts out of compliance
Setting Both Up Properly
- Enable CloudTrail across all regions, not just the ones you actively use — resources can be created anywhere
- Send CloudTrail logs to a dedicated, access-restricted S3 bucket with logging enabled on the bucket itself
- Enable AWS Config in every region and account, and turn on the managed rules relevant to your compliance requirements
- Set up CloudWatch Alarms for high-risk events — root account logins, security group changes, IAM policy changes
What This Solves in Practice
- A security group changes unexpectedly — CloudTrail shows who changed it, Config shows exactly what changed
- An S3 bucket becomes public — Config flags it immediately, and can auto-remediate before it becomes an incident
- An auditor asks for proof of change control — CloudTrail and Config logs answer it directly, without manual reconstruction
Common Gaps
- CloudTrail enabled in the primary region only, missing activity in others
- Logs stored without restricted access, meaning the audit trail itself could be tampered with
- Config enabled but no rules actually configured, leaving it collecting data without evaluating anything
- No alerting connected to either service, so issues are only discovered well after the fact
CloudTrail and Config are two of the least visible AWS services in daily operations, and two of the most important the moment something goes wrong or an audit comes due. Both are inexpensive to run and expensive to have missed enabling.
