Audit Logs and Privacy

Proving it afterwards. CloudTrail management and data events over data stores, the service-native logs that answer questions CloudTrail cannot, centralising and querying logs for an audit, and the privacy duties — residency, retention, deletion requests, and lineage as evidence — that turn governance from a policy document into a pipeline requirement.

Content current as of 2026-10.

Lessons

1. CloudTrail over data stores
2. The logs CloudTrail does not have
3. Centralising logs for an audit
4. Privacy, residency, and deletion

Sources

• AWS CloudTrail user guide — logging data events
• AWS Lake Formation developer guide — logging Lake Formation API calls using AWS CloudTrail
• Amazon Redshift management guide — database audit logging
• Amazon S3 user guide — logging requests with server access logging
• Amazon DataZone user guide — Amazon DataZone data catalog