Question

A security analyst configured a multi-Region CloudTrail trail delivering management events to an S3 bucket. During an incident investigation, they notice that an API call known to have occurred at 14:02 UTC does not appear in the S3 bucket when they check at 14:08 UTC. The trail is enabled, the S3 bucket policy is correct, and log file validation shows no gaps once files arrive. What is the MOST likely explanation, and what should the analyst do?

Accepted Answer

CloudTrail typically delivers log files to S3 within about 15 minutes of an API call; the analyst should wait and recheck, as this delay is expected behavior.

Answer

The trail is missing an SNS notification configuration, which is required before any events can be written to S3.

Answer

Management events are not captured by default and must be explicitly enabled with a data event selector before they appear in the bucket.

Answer

The event was a global service event that is only delivered to the trail's home Region bucket prefix, so it will never appear in a multi-Region trail.