Looking to save $$$ while keeping your AWS Account secure?

Looking to save $$$ while keeping your AWS Account secure?

Having an audit trail where you can review actions taken in your AWS account is a crucial part of cloud security.

CloudTrail lets you do this, but if set up correctly, it can be costly.

I recommend you use either their EventSelector field or their AdvancedEventSelector if you really want to get tricky.

Though it may be useful to see 100% of requests made, both reads and writes, that is a lot of data to store long term.

If you want to be super secure, I say store it all, but keep in mind when browsing the AWS console every page load comes with 20 or so read requests.

All this can add up over time to hundreds of GBs.

If you are a little more price-sensitive and less worried about logging every read request, you might consider setting the [ReadWriteType](https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_EventSelector.html#:~:text=Required%3A%20No-,ReadWriteType,-Specify%20if%20you) to WriteOnly.

As always, I suggest doing this via an IaC tool such as Terraform.

If you need help setting up security access logs, feel free to reach out or check out my On-Demand Video Course On O'Reilly - Zero to Hero on AWS Security: An Animated Guide to Security in the Cloud