30.5 Detection: CloudTrail, GuardDuty, Config and Security Hub

By Ravindra Bagale Last updated: 27 September 2026

You cannot defend what you cannot see. AWS gives four key detection services:

Service	What it does	Think of it as
CloudTrail	Records every API call: who did what, when, from which IP	The account's CCTV recording
GuardDuty	Analyses CloudTrail, VPC Flow Logs and DNS logs to spot threats (crypto-mining, calls from known bad IPs, unusual logins)	An automatic security guard
AWS Config	Tracks configuration changes and checks rules like "no public S3" or "EBS must be encrypted"	A compliance checklist that runs itself
Security Hub	Collects findings from GuardDuty, Config, Inspector and more into one dashboard with best-practice scores	The control room

Minimum setup for any real account:

Create a multi-region CloudTrail trail that writes to a dedicated S3 bucket (with Block Public Access and versioning on).
Enable GuardDuty and send high-severity findings to your email through EventBridge and SNS.
Keep a billing alarm (Chapter 12) – a sudden bill spike is often the first sign of stolen keys.
Turn on VPC Flow Logs for the VPC to see accepted and rejected network traffic.

# Who deleted something recently? Look up events in CloudTrail
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=DeleteBucket --max-results 5
# Any console logins without MFA?
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=ConsoleLogin --max-results 10

Ravindra Bagale's Tip

If CloudTrail is not turned on, after a hack you will never know "what happened". Logs are the first piece of evidence in an investigation. Set up the trail and a billing alarm on the day you open the account – not later.

Lab

Create a multi-region trail. Make a harmless change (create and delete an empty test bucket), then find both events in CloudTrail Event history and note the user, time and source IP. If you enable the GuardDuty free trial, open Settings, Generate sample findings and read three findings. Disable anything you will not keep after the lab.