AWS CloudTrail (IAM)

AWScloudtrailmonitoring

AWS CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your AWS account.

iamaws

docs ↗

Permissions

Actions in this service

cloudtrail:DescribeTrails

cloudtrail:GetTrail

cloudtrail:GetTrailStatus

cloudtrail:ListTrails

cloudtrail:StartLogging

cloudtrail:StopLogging

cloudtrail:GetEventSelectors

cloudtrail:PutEventSelectors

Policy

Minimal privilege example

Copy-paste least-privilege policy statement — not yet harness-verified.

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudtrail:DescribeTrails", "cloudtrail:GetTrail", "cloudtrail:GetTrailStatus", "cloudtrail:ListTrails", "cloudtrail:StartLogging", "cloudtrail:StopLogging", "cloudtrail:GetEventSelectors", "cloudtrail:PutEventSelectors" ], "Resource": "*" } ] }

SDK mapping

Method → permission

SDK method mapping (e.g. boto3.get_object() → s3:GetObject) is not yet collected.

Footguns

Known gotchas

Avoid cloudtrail:* — grants full control including trail deletion and configuration changes

Avoid cloudtrail:DeleteTrail and cloudtrail:StopLogging — can disable audit logging and break compliance

Resources

docshttps://servicereference.us-east-1.amazonaws.com/v1/cloudtrail/cloudtrail.json ↗