CloudTrail

AWS CloudTrail allows customers to record the API calls made to the AWS account. This is very useful for auditing purpose, so you know what users are doing. The audit log provided by CloudTrail is much more useful to troubleshoot operational and security incidents, which, in turn, helps the organization to demonstrate its compliance with policies and regulatory standards. The CloudTrail log is saved in the S3 bucket, and you can send CloudTrail logs to CloudWatch for monitoring specific events. CloudTrail events can be processed by one trail for free. There is a charge for processing events by additional trails.