I haven't worked in an environment that had any compliance or data retention policies (well, there was that MS Outlook IMAP/POP3  incident, but thankfully there was a backup), so a lot of this stuff I make up as I go along. So, today I discovered CloudTrail and I must say, it is pretty cool.

CloudTrail monitors your environment API calls, so when some one does anything, there is a record of it. You get one "trail" for free, so I set one up to go to an S3 bucket. According to the pricing document (see, I'm learning, I checked the pricing first!) most environments cost less that $3 per month, so I think this is a good purchase.

To test it out, I turned on a NAT instance to see when the event would be logged. It took about 10 minutes for the event to get registered in the log, so some patience is in order.

The event was also copied in JSON format to my logs bucket, so once I find an  app to de-minimize the code and maybe build a parser, it will be useful. Until then, it is taking up space in a bucket, which has policies to rotate the contents to Infrequent Access storage after 30 days, then off to Glacier for a bit more  than a year before being chucked in the bit bucket. This will have to do until we document some more formal retention policies.