# CloudTrail audit for agent operations
## The rule
If an agent can call the AWS API, those calls are logged. No automation account runs without CloudTrail.
## Setup
1. Create an organization trail covering all regions. A regional trail misses the region you forgot.
2. Turn on log file validation so tampering with log files is detectable.
3. Deliver logs to a dedicated S3 bucket with restricted access: no public access, tight bucket policy, versioning on.
4. Protect the log bucket itself: block deletes with Object Lock or MFA delete, and alert on any policy change to the bucket.
## Using it
1. When something unexpected happens, the first question is CloudTrail: which identity made the call, from which source IP, with what parameters.
2. Alert on the high-signal events: ConsoleLogin without MFA, IAM policy changes, CloudTrail configuration changes, and root usage.
3. Keep logs long enough to matter. Ninety days in the trail plus archived years in S3 is a sane default.