cloudtrail

Monitor, analyze and audit AWS CloudTrail trails and events via CLI.

3|Updated Mar 16, 2026
One-click install
npx skills add https://github.com/david-2814/claw-aws --skill cloudtrail
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: cloudtrail
Source: https://github.com/david-2814/claw-aws/tree/main/skills/cloudtrail
Command: npx skills add https://github.com/david-2814/claw-aws --skill cloudtrail

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Auditors and security teams can centrally monitor, analyze, and audit AWS activity using CloudTrail trails and event data to meet governance requirements.

Core Features & Use Cases

  • View API event history across accounts and regions
  • Create, manage, and inspect CloudTrail trails and insights
  • Query CloudTrail Lake and correlate events for security investigations and compliance reporting

Quick Start

Configure a trail with the AWS CLI, then start querying events to begin auditing.

Frequently Asked Questions about cloudtrail

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit AWS API activity across multiple accounts for compliance investigations?

To audit AWS API activity for compliance, you can view API event history across accounts and regions by configuring CloudTrail trails. This allows security teams to centrally monitor and analyze event data to meet governance requirements.

What do I need to set up before querying CloudTrail event history through the CLI?

Before querying CloudTrail event history, you need AWS CLI v2 installed and valid AWS credentials configured. Once these prerequisites are met, you can configure a trail and start looking up events to begin auditing.

Can I query CloudTrail Lake to correlate events during an incident investigation?

Yes, you can query CloudTrail Lake to correlate events for security investigations and compliance reporting. This enables auditors to analyze AWS activity and track changes across accounts during incident response workflows.

What is the best way to track configuration changes in my AWS environment for risk management?

The best way to track configuration changes for risk management is by inspecting CloudTrail trails and insights. This approach allows you to analyze AWS activity and maintain a centralized audit record for governance and compliance workflows.

Does this approach work for viewing API event history across different AWS regions?

Yes, this approach supports viewing API event history across multiple AWS accounts and regions. It allows auditors and security teams to centrally monitor and analyze AWS activity using CloudTrail trails and event data.

Why are my CloudTrail logs not capturing all the events I need for a compliance report?

CloudTrail logs may not capture all needed events if trails are not properly configured across all required regions. You can manage and inspect CloudTrail trails to ensure they are correctly set up to record activity for compliance reporting.