How do I choose between data events and management events in CloudTrail?

Resolution

When to choose data events

CloudTrail data events show operations that occur on or within resources in your AWS account. Because data events are high-volume, they can generate millions of log entries per day.

Use data events to track and audit operations on resources. For example:

• Track Amazon Simple Storage Service (Amazon S3) API operations on objects, such as GetObject, DeleteObject, and PutObject.
• Monitor AWS Lambda function invocations.
• Audit Amazon DynamoDB operations on table items, such as PutItem, DeleteItem, and UpdateItem.
• Track Amazon Elastic Block Store (Amazon EBS) API activity, such as PutSnapshotBlock and GetSnapshotBlock.
• Monitor Amazon Cognito API activity on user pools.
• Track Amazon Simple Notification Service (Amazon SNS) API operations on topics, such as Publish and PublishBatch.

By default, trails don't log data events, and data events don't appear in CloudTrail event history. To activate data event logging, add the supported resources or resource types to a trail. To view data events, check your CloudTrail log files.

Note: Additional charges apply for data event logging because of the high volume of events. For more information, see AWS CloudTrail pricing.

When to choose management events

CloudTrail management events show operations that occur on resources in your AWS account. These are account-level actions that create, modify, or delete AWS resources.

Use management events to track and audit account-level operations. For example:

• Create an Amazon S3 bucket.
• Create and manage AWS Identity and Access Management (IAM) resources.
• Register devices.
• Configure routing table rules.
• Set up logging.

By default, CloudTrail logs management events across AWS services. You can access and download the last 90 days of management events with CloudTrail event history or the LookupEvents API.

Note: You can create a trail to store one copy of management events in Amazon S3 beyond the 90-day retention period. Additional copies of management events can incur a charge. For more information, see AWS CloudTrail pricing.