CloudTrail audit: every agent action attributable

TL;DR

Protect the log bucket itself: block deletes with Object Lock or MFA delete, and alert on any policy change to the bucket. Alert on the high-signal events: ConsoleLogin without MFA, IAM policy changes, CloudTrail configuration changes, and root usage.

Steps

1. When something unexpected happens, the first question is CloudTrail: which identity made the call, from which source IP, with what parameters.
2. Alert on the high-signal events: ConsoleLogin without MFA, IAM policy changes, CloudTrail configuration changes, and root usage.
3. Keep logs long enough to matter. Ninety days in the trail plus archived years in S3 is a sane default.

When to use

You are seeing this: If an agent can call the AWS API, those calls are logged. Use this skill when you run into "CloudTrail audit: every agent action attributable".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Covers CloudTrail trails across regions, log file validation, and dedicated log delivery buckets. Verified against the live CloudTrail user guide. https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html