Correct: b. No trail = no forensics.

Where should the org trail bucket live?

Correct: b. Camera away from the suspect.

Amazon · AWS security · Lesson 7 of 10

The camera: CloudTrail records, GuardDuty judges, Hub collects

Someone used a leaked key. You have no trail in the member account. Event history is a short, management-only window — not an investigation archive. CloudTrail is the camera (every account, preferably an organization trail). GuardDuty is findings. Security Hub is the aggregator. No trail = no forensics.

Updated 2026-08-18·18 min read·L2 primary·Quiz at end

After this page you can

Turn on an org multi-region trail to a log-archive bucket before you need it.
Separate Trail (evidence) from GuardDuty (findings) from Security Hub (rollup).
Know Event history is not a substitute for a trail.
Prove with describe-trails, list-detectors, and describe-hub.

The ticket

CISO: “Who deleted tc-lab-app-logs objects last month?” There is no trail. Event history never records S3 data events, and it is not an archive. GuardDuty is off. Security Hub is an empty subscription someone clicked once.

Quick interview answer

CloudTrail records AWS API activity. Create a trail (multi-region, org trail from the management or delegated admin account) that delivers to S3 — this lab would land in the Security OU, not in the app account. Console Event history is only recent management events; it is not your archive and it is not data events. GuardDuty analyzes CloudTrail, VPC Flow Logs, DNS, and other signals and emits findings — it is not a camera of every call. Security Hub aggregates findings (GuardDuty, Access Analyzer, Inspector, partners) and runs security standards. Disable the trail and you are blind on purpose.

CloudTrail archive feeding GuardDuty findings into Security Hub — GuardDuty without a trail still needs telemetry. A trail without anyone reading it is how last month disappears.

Lab data · dummy only

Account 111122223333 · OUs Security / Workloads · hub VPC 10.50.0.0/16 · app VPC 10.51.0.0/16 · SG sg-web · NACL acl-app · bucket tc-lab-app-logs · role AppEC2Role · TGW tgw-lab · VGW public 203.0.113.60 · on-prem FortiGate WAN 203.0.113.10. Dummy account ID. Not yours.

Mental model

Service	Job	Not its job
CloudTrail	Record the API (camera)	Tell you it was malicious
GuardDuty	Findings from telemetry	Replace the trail archive
Security Hub	Aggregate + standards	Be the only log store

One way evidence flows

Camera first. Findings second. Rollup third. Do not reverse that in an incident.

https://111122223333.signin.aws.amazon.com/console

Training mock · not live

AWS console

VPCIAMS3CloudTrail

CloudTrail → Trails

org-trail-lab

Trail type

Organization trail · all member accounts · multi-region

Storage

Log-archive bucket in Security OU · SSE-KMS · integrity validation

Management events

All · read + write

Data events

Add S3 data events for tc-lab-app-logs when you need object-level forensics

GuardDuty / Hub

Detector on · Security Hub standards + finding ingest

No trail = no forensics. Training mock.

How to choose

Question	Where
What API ran, as whom, from where, when?	CloudTrail (trail in S3 / Lake), not a GuardDuty title
Does this look like stolen creds / crypto / recon?	GuardDuty finding
Are we failing FSBP / CIS controls across accounts?	Security Hub standards
Object-level GetObject last month?	Only if you enabled S3 data events on a trail

Runbook

Side A — camera
Org trail, multi-region, log file validation, to a Security OU bucket that apps cannot delete. SCP (lesson 2) denies cloudtrail:StopLogging / delete-trail in Workloads.
Side B — findings
Enable GuardDuty in the accounts (or delegated admin). Enable Security Hub and the standards you actually review.
Side C — prove
Make a harmless API call. See it in the trail file / Lake. Confirm a detector id exists. Do not declare “logging is on” from Event history alone.

aws cli · camera proof

aws cloudtrail describe-trails
# Name: org-trail-lab   IsOrganizationTrail: true   IsMultiRegionTrail: true
# S3BucketName: tc-lab-org-trail   LogFileValidationEnabled: true

aws cloudtrail get-trail-status --name org-trail-lab
# IsLogging: true

aws guardduty list-detectors
# detector-lab01

aws securityhub describe-hub
# HubArn: arn:aws:securityhub:...:111122223333:hub/default

Four failures

1 · No trail, only Event history

Short window, management events, not an archive. You will lose last month.

2 · Trail in the app account, app role can s3:DeleteObject on the log bucket

The suspect deletes the camera. Put logs in the Security OU with a restrictive bucket policy.

3 · GuardDuty on, trail off, “we have monitoring”

Findings without durable API history. You cannot reconstruct.

4 · Security Hub enabled, nobody owns failed controls

A dashboard is not a control. Assign the standard; do not screenshot it once a year.

How to prove it

Close only when

1) describe-trails shows an org, multi-region, logging trail. 2) The log bucket is not writable by AppEC2Role. 3) GuardDuty has a detector. 4) You can find your own test API in the trail.

Traps

Said in interview	Correction
GuardDuty is our CloudTrail	Different products — camera vs findings
Event history is the trail	It is not durable org-wide evidence
Hub stores every API call	Hub stores findings and control results

AWS security class series: Shared + IAM · Org / OU · SG vs NACL · Role not key · KMS + Secrets · VPC endpoint · Trail + GuardDuty · TGW hub · S3 public · Interview