CloudTrail Is the Foundation of SOC 2 Logging Controls

SOC 2's CC7.2 criterion (monitoring of security events) requires that you detect and respond to anomalous activity. CloudTrail is the primary mechanism for this in AWS — it records every API call made in your account: who did what, when, from where, and whether it succeeded.

Without CloudTrail, you cannot prove to an auditor that you detect unauthorized access, configuration changes, or data exfiltration. With it properly configured, you have a tamper-evident audit trail that satisfies multiple SOC 2 control requirements simultaneously.

Step 1 — Create a Multi-Region Trail

A single-region trail only logs events in that region. AWS workloads span regions, and attackers know which regions teams typically ignore. A multi-region trail logs all regions including opt-in regions and global service events.

aws cloudtrail create-trail \
  --name soc2-audit-trail \
  --s3-bucket-name your-cloudtrail-logs-bucket \
  --is-multi-region-trail \
  --include-global-service-events \
  --enable-log-file-validation \
  --kms-key-id arn:aws:kms:REGION:ACCOUNT:key/KEY-ID
aws cloudtrail start-logging --name soc2-audit-trail

Key flags:

• --is-multi-region-trail — captures all regions
• --include-global-service-events — captures IAM, STS, Route 53 (global services)
• --enable-log-file-validation — cryptographic proof logs haven't been tampered with
• --kms-key-id — encrypts logs with a customer-managed key

SecureSpect check: aws.cloudtrail.multi_region and aws.cloudtrail.log_file_validation.

Step 2 — Lock the Log Destination Bucket

CloudTrail logs are only a complete audit trail if they can't be deleted. Configure S3 Object Lock on the log destination bucket with Compliance mode (not Governance — an admin can override Governance mode):

# Object Lock must be enabled at bucket creation
aws s3api create-bucket \
  --bucket your-cloudtrail-logs-bucket \
  --object-lock-enabled-for-bucket
aws s3api put-object-lock-configuration \
  --bucket your-cloudtrail-logs-bucket \
  --object-lock-configuration '{
    "ObjectLockEnabled": "Enabled",
    "Rule": {
      "DefaultRetention": {
        "Mode": "COMPLIANCE",
        "Days": 365
      }
    }
  }'

Also apply an S3 bucket policy that denies s3:DeleteObject and s3:DeleteBucket except to an explicitly named log archive role. Block public access at the bucket and account level.

Step 3 — Enable CloudWatch Logs Integration

Sending CloudTrail events to CloudWatch Logs enables real-time alerting on security-relevant events. Create metric filters and alarms for:

• Root account usage
• IAM policy changes
• Console sign-in failures (potential brute force)
• S3 bucket policy changes
• Unauthorized API calls (AccessDenied errors)

aws cloudtrail update-trail \
  --name soc2-audit-trail \
  --cloud-watch-logs-log-group-arn arn:aws:logs:REGION:ACCOUNT:log-group:CloudTrail/soc2 \
  --cloud-watch-logs-role-arn arn:aws:iam::ACCOUNT:role/CloudTrailToCloudWatch

Example metric filter for root account usage:

{
  "filterPattern": "{ $.userIdentity.type = Root && $.userIdentity.invokedBy NOT EXISTS && $.eventType != AwsServiceEvent }",
  "metricName": "RootAccountUsage",
  "metricNamespace": "SecurityMetrics",
  "metricValue": "1"
}

Create a CloudWatch alarm on this metric and route to an SNS topic that pages your on-call. Root account usage outside of emergency procedures is a security incident.

Step 4 — Verify Log Integrity Regularly

Log file validation creates SHA-256 hashes for every delivered log file. Verify them periodically to prove to auditors that log integrity is maintained:

aws cloudtrail validate-logs \
  --trail-arn arn:aws:cloudtrail:REGION:ACCOUNT:trail/soc2-audit-trail \
  --start-time 2026-01-01T00:00:00Z \
  --end-time 2026-09-30T00:00:00Z \
  --verbose

Document this validation as part of your quarterly compliance review. The output confirms which log files were valid and flags any that were modified after delivery.

What Auditors Actually Test

|---|---|---|

SecureSpect checks CloudTrail configuration on every sync — multi-region enabled, log file validation on, CloudWatch integration active, and the S3 log bucket protected from public access and deletion.