Cloud Access Trails
AWS CloudTrail
Management events & IAM activity
IntegraTrace collects audit events from AWS CloudTrail for real-time visibility into IAM activity, resource changes, and API calls across your AWS environment.
Data source
CloudTrail Event History via the LookupEvents API.
Events captured
Management events including IAM changes, resource creation/deletion, and API calls.
Required permissions
cloudtrail:LookupEvents
Identity types
IAM users, assumed roles, the root account, AWS service accounts, and federated users (SAML, OIDC).
What we track for each event
Principal
The IAM identity that performed the action (user ARN, role ARN, or service name).
Action
The AWS API action performed (e.g. CreateUser, DeleteBucket).
Service & resource
The AWS service (e.g. IAM, S3, EC2) and the specific resource ARN accessed.
Event metadata
Timestamp, AWS region, event ID, success/failure status, and error details.
Key use cases
Detect unauthorized IAM changes
Monitor for unexpected modifications to IAM users, roles, policies, or permission boundaries that could indicate a breach or privilege escalation.
Track failed authentication
Identify patterns of failed API calls or console sign-ins that may indicate credential stuffing or compromised credentials.
Monitor root account activity
Alert on any root account usage, which should be rare and carefully controlled per AWS best practices.
Audit resource deletions
Track when critical resources are deleted to support forensics and change management.
Need to configure access? Follow the AWS setup guide to grant the required permissions.