Which CloudTrail event types are most important for SOC 2 evidence?

Events related to IAM changes (user creation, policy attachment, access key creation), sign-in events from signin.amazonaws.com, and any errorCode: AccessDenied on sensitive APIs. These directly satisfy CC6.1 (access controls implemented) and CC6.3 (access restriction for sensitive activities).

Does SOC 2 require CloudTrail to be enabled in all AWS regions?

Yes, if your infrastructure spans multiple regions. SOC 2 auditors expect coverage to match your actual AWS footprint. An organization-level trail or multi-region trail is the typical implementation. Single-region CloudTrail in a multi-region deployment is a finding.

How long do we need to retain CloudTrail logs for SOC 2?

At least the audit period (typically 12 months), plus enough prior history to establish a baseline for anomaly comparison. Common practice is 1 year in the primary S3 bucket and longer in cold storage for forensics purposes.

Can a single LogTriage report serve as SOC 2 evidence, or do auditors want raw logs?

Typically both. The LogTriage report demonstrates that logs are reviewed, anomalies are detected, and findings are documented — satisfying the monitoring component. Raw CloudTrail exports or S3 log references satisfy the log retention and availability component. Neither alone is complete.

SOC 2 Evidence from AWS CloudTrail

Why this matters for SOC 2

If your production infrastructure runs on AWS, CloudTrail is the primary evidence source for almost every infrastructure-related SOC 2 control — who made what change, who assumed what role, and whether access followed least-privilege principles. Auditors will ask for it by name.

What evidence CloudTrail provides

A complete, append-only record of every IAM change (CC6.3 — role-based access and least privilege)
Evidence of system monitoring for anomalous API activity, supporting CC7.2
A record of console and API access patterns that can demonstrate access reviews are grounded in actual usage, not just policy documents
Cross-account access and AssumeRole activity, which is frequently the specific evidence requested for multi-account AWS organizations

How LogTriage maps this to SOC 2 controls

IAM-modifying CloudTrail events are mapped to MITRE ATT&CK privilege escalation techniques, which the compliance mapper then ties to CC6.3 (Role-Based Access and Least Privilege). Detected exfiltration-pattern activity maps to CC7.2 (System Monitoring) automatically, with the specific evidence note an auditor expects attached to the report.

Evidence checklist

Confirm CloudTrail is enabled in every account and region in scope, including organization-level trails
Verify log file integrity validation is enabled — auditors specifically check for this
Retain evidence of IAM access reviews and tie them to actual CloudTrail-observed usage
Document the retention period for CloudTrail logs and confirm it meets your SOC 2 evidence window requirement
Maintain a record of any privilege escalation alerts and their resolution

Frequently Asked Questions

Which CloudTrail event types are most important for SOC 2 evidence?: Events related to IAM changes (user creation, policy attachment, access key creation), sign-in events from signin.amazonaws.com, and any errorCode: AccessDenied on sensitive APIs. These directly satisfy CC6.1 (access controls implemented) and CC6.3 (access restriction for sensitive activities).
Does SOC 2 require CloudTrail to be enabled in all AWS regions?: Yes, if your infrastructure spans multiple regions. SOC 2 auditors expect coverage to match your actual AWS footprint. An organization-level trail or multi-region trail is the typical implementation. Single-region CloudTrail in a multi-region deployment is a finding.
How long do we need to retain CloudTrail logs for SOC 2?: At least the audit period (typically 12 months), plus enough prior history to establish a baseline for anomaly comparison. Common practice is 1 year in the primary S3 bucket and longer in cold storage for forensics purposes.
Can a single LogTriage report serve as SOC 2 evidence, or do auditors want raw logs?: Typically both. The LogTriage report demonstrates that logs are reviewed, anomalies are detected, and findings are documented — satisfying the monitoring component. Raw CloudTrail exports or S3 log references satisfy the log retention and availability component. Neither alone is complete.

See your compliance mapping generated automatically

Every LogTriage report includes a deterministic compliance mapping — SOC 2, PCI DSS, HIPAA, NIST CSF, and ISO 27001 — stamped on every report, AI-generated or rule-based.

Try Live Demo → Analyze Your Own Logs