Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

CloudTrail supported services and integrations

CloudTrail supports logging events for many Amazon Web Services services. You can find the specifics for each supported service in that service's guide. For a list of service-specific topics, see Amazon service topics for CloudTrail. In addition, some Amazon Web Services services can be used to analyze and act upon data collected in CloudTrail logs.

Amazon service integrations with CloudTrail logs

You can configure other Amazon services to further analyze and act upon the event data collected in CloudTrail logs. For more information, see the following topics.

CloudTrail integration with Amazon EventBridge

Amazon EventBridge is an Amazon service that delivers a near real-time stream of system events that describe changes in Amazon resources. In EventBridge, you can create rules that responds to events recorded by CloudTrail. For more information, see Create a rule in Amazon EventBridge.

You can deliver events that you are subscribed to on your trail to EventBridge by creating a rule with the EventBridge console.

From the EventBridge console:

For more information about how to create a trail, see Creating a trail with the CloudTrail console.

CloudTrail integration with Amazon Organizations

The management account for an Amazon Organizations organization can add a delegated administrator to manage the organization's CloudTrail resources. You can create an organization trail or organization event data store in the management account or delegated administrator account for an organization that collects all event data for all Amazon accounts in an organization in Amazon Organizations. Creating an organization trail or organization event data store helps you define a uniform event logging strategy for your organization.

CloudTrail integration with Amazon Control Tower

Amazon Control Tower sets up a new CloudTrail organization trail logging management events when you set up a landing zone. When you enroll an account into Amazon Control Tower, your account is governed by the organization trail for the Amazon Control Tower organization. If you have an existing organization trail in that account, you may see duplicate charges unless you delete the existing trail for the account before you enroll it in Amazon Control Tower. You can view the Trails page on the CloudTrail console to see whether any organization trails have been created. For more information about Amazon Control Tower, see About logging in Amazon Control Tower in the Amazon CloudTrail User Guide.

CloudTrail integration with Amazon Security Lake

Security Lake can collect logs associated with CloudTrail management events and CloudTrail data events for S3 and Lambda. For more information, see CloudTrail event logs in the Amazon Security Lake User Guide.

To collect CloudTrail management events in Security Lake, you must have at least one CloudTrail multi-Region organization trail that collects read and write CloudTrail management events.

CloudTrail Lake integration with Amazon Athena

You can federate an event data store to see the metadata associated with the event data store in the Amazon Glue Data Catalog and run SQL queries on the event data using Amazon Athena. The table metadata stored in the Amazon Glue Data Catalog lets the Athena query engine know how to find, read, and process the data that you want to query. For more information, see Federate an event data store.

CloudTrail Lake integration with Amazon Config

You can create an event data store to include Amazon Config configuration items, and use the event data store to investigate non-compliant changes to your production environments. For more information, see Create an event data store for configuration items with the console.

CloudTrail Lake integration with Amazon Audit Manager

You can create an event data store for Amazon Audit Manager evidence by using the Audit Manager console. For more information about aggregating evidence in CloudTrail Lake using Audit Manager, see Understanding how evidence finder works with CloudTrail Lake in the Amazon Audit Manager User Guide.

Amazon service topics for CloudTrail

You can learn more about how the events for individual Amazon services are recorded in CloudTrail logs, including example events for that service in log files. For more information about how specific Amazon services integrate with CloudTrail, see the topic about integration in the individual guide for that service.

Services that are still in preview, or not yet released for general availability (GA), or which don't have public APIs, are not considered supported.

CloudTrail unsupported services

Services that are still in preview, or not yet released for general availability (GA), or which don't have public APIs, are not considered supported.

Additionally, the following Amazon services and events are not supported:

For a list of supported Amazon services, see Amazon service topics for CloudTrail.