Tutorial: Review Amazon account activity in event history - Amazon CloudTrail
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Tutorial: Review Amazon account activity in event history

CloudTrail is active in your Amazon account when you create the account. When supported API activity (management events) occurs in any Amazon service that supports CloudTrail, that activity is recorded in a CloudTrail management event along with other Amazon service events in Event history. In other words, you can view, search, and download recent management events in your Amazon account before creating a trail, though creating a trail is important for long-term records and auditing of your Amazon account activity.

Note

The following limitations apply to the Event history.

  • The Event history page in the CloudTrail console only shows management events. It does not show data events or Insights events.

  • The Event history is limited to the past 90 days of events. For an ongoing record of events in your Amazon Web Services account, create a trail.

  • The Event history doesn't provide organization level event aggregation. To record events across your organization, create a trail.

  • An Event history search is limited to a single Amazon Web Services account, only returns events from a single Amazon Web Services Region, and cannot query multiple attributes.

  • You cannot exclude Amazon KMS events from Event history; settings that you apply to a trail do not apply to Event history. For more information, see Working with CloudTrail Event history.

To view Event history
  1. Sign in to the Amazon Web Services Management Console and open the CloudTrail console at https://console.amazonaws.cn/cloudtrail/.

  2. In the navigation pane, choose Event history. You see a filtered list of events, with the most recent events showing first. The default filter for events is Read only, set to false. You can clear that filter by choosing X at the right of the filter. You can search events in Event history by filtering for events on a single attribute

  3. Many more events are shown without the default filter. You can filter events in many ways. For example, to view all console login events, you could choose the Event name filter, and specify ConsoleLogin. The choice of filters is up to you.

  4. To view a specific management event, choose the event name. On the event details page, you can view details about the event, see any referenced resources, and view the event record.

  5. To view the recent management events for a service, filter on the event source.

  6. You can save event history by downloading it as a file in CSV or JSON format. Downloading your event history can take a few minutes.

For more information, see Working with CloudTrail Event history.