Home / AWS

AWSHow-toIntermediate

AWS logging and security foundation: org CloudTrail, Config, GuardDuty and Security Hub

Centralise audit logs and security findings across all accounts and regions with delegated administrators, then route the findings that matter to the operations team.

Deepak Bhardwaj2 min read

Applies toAWS CloudTrail, AWS Config, Amazon GuardDuty, AWS Security Hub, Amazon CloudWatch

1. Organisation trail

Control Tower creates one; otherwise:

aws cloudtrail create-trail --name org-trail --s3-bucket-name org-cloudtrail-logs-111122223333 \
  --is-organization-trail --is-multi-region-trail --enable-log-file-validation \
  --kms-key-id arn:aws:kms:ap-south-1:111122223333:key/<key-id>
aws cloudtrail start-logging --name org-trail
  • The log bucket lives in the Log Archive account, with Object Lock or a deny-delete bucket policy, versioning and lifecycle to Glacier.
  • Add data events only where needed (for example S3 object access on sensitive buckets). They cost per event.

2. AWS Config

Recorder in every account and governed region, aggregator in the Audit account. Conformance packs (for example operational best practices for CIS or for your framework) give a compliance view.

3. GuardDuty and Security Hub with delegated admin

aws guardduty enable-organization-admin-account --admin-account-id 222233334444
aws securityhub enable-organization-admin-account --admin-account-id 222233334444

From the Audit account: auto-enable for new accounts, enable GuardDuty protection plans you need (S3, EKS, malware, RDS), and Security Hub standards (AWS Foundational Security Best Practices).

4. Route findings to people

EventBridge rule in the Audit account for high-severity findings:

{
  "source": ["aws.guardduty"],
  "detail-type": ["GuardDuty Finding"],
  "detail": { "severity": [{ "numeric": [">=", 7] }] }
}

Target: SNS → email/chat, or your ITSM. Medium findings go to a weekly review, not a pager.

5. Operational logs

  • VPC flow logs, ALB access logs, CloudFront logs → central S3 (Log Archive) or CloudWatch Logs with subscription filters.
  • CloudWatch Logs retention set on every log group (the default is never expire).
aws logs describe-log-groups --query "logGroups[?retentionInDays==null].logGroupName" --output text
aws logs put-retention-policy --log-group-name /aws/lambda/orders --retention-in-days 90

6. Query when an incident happens

Use CloudTrail Lake or Athena over the trail bucket:

SELECT eventtime, useridentity.arn, eventname, sourceipaddress, errorcode
FROM cloudtrail_logs
WHERE eventsource = 'ec2.amazonaws.com' AND eventname LIKE 'Terminate%'
  AND eventtime > '2026-10-21T00:00:00Z'
ORDER BY eventtime DESC;

DR note

Enable all of this in the DR region too. Attackers and outages don't respect your primary region, and a DR failover into a region without GuardDuty or Config is a blind spot exactly when you need visibility.

Related fixes