Skip to content
AWS · Security logs

AWS CloudTrail Log Analyzer

Drop CloudTrail logs to find failed calls, root activity, risky IAM changes and unusual sources in seconds — parsed in your browser.

Last updated

CloudTrail Log Analyzer

Security audit & threat detection for AWS environments

AWS CloudTrail Client-side only No data uploaded

Drop CloudTrail JSON log file here

Supports .json CloudTrail log files — analyzed entirely in your browser

or paste raw JSON below
No log handy? Load a sample CloudTrail log to try the analyzer.
Summary
Security Findings
Threat Detection & Anomalies 0 findings
Event Timeline
Events per hour
Top IAM users / roles
Top events
Top source IPs
AWS regions
AWS Service Breakdown
Event Log
Time (UTC) Event name Service User / Role Source IP Region Status
—

What is AWS CloudTrail and why should you analyze it?

AWS CloudTrail records every API call made in your AWS account — who did what, when, from where, and whether it succeeded. Analyzing these logs is essential for security auditing, compliance (SOC 2, PCI-DSS, HIPAA), incident response, and detecting insider threats or compromised credentials. This tool parses your CloudTrail JSON logs entirely in your browser — your data never leaves your machine.

What threats does CloudTrail log analysis detect?
Root account logins, failed authentication attempts (brute force), privilege escalation via IAM policy changes, unusual geographic access, S3 bucket policy modifications, security group changes, new API keys, CloudTrail log tampering, and mass resource deletion events.
How do I download my CloudTrail logs from AWS?
Go to AWS Console → CloudTrail → Event History → Download events (JSON). Alternatively, your logs are stored in an S3 bucket (typically named aws-cloudtrail-logs-*). Download individual .json.gz files and decompress them. Each file contains a "Records" array of API events.
Is my CloudTrail data safe to upload here?
Yes — this tool runs entirely in your browser using JavaScript. Your log data is never transmitted to any server. You can verify this by checking your browser's network tab while running the analysis. No account data, IP addresses, or event information ever leaves your device.
What does errorCode in CloudTrail mean?
An errorCode field indicates the API call failed. Common codes: AccessDenied (missing IAM permissions), InvalidClientTokenId (invalid credentials), UnauthorizedOperation (EC2 authorization failure), NoSuchBucket (missing S3 bucket). High rates of AccessDenied from one principal often indicate a misconfiguration or credential stuffing attack.
What AWS services generate the most CloudTrail events?
IAM (identity operations), S3 (object access when data events enabled), EC2 (instance management), STS (AssumeRole calls), Lambda (invocations), CloudFormation (stack operations), and RDS (database management) are typically the highest-volume sources in production accounts.
How do I detect credential compromise in CloudTrail?
Look for: API calls from new geographic regions or IPs, unusual hours of activity, sudden spikes in IAM or STS calls, CreateAccessKey followed by new service usage, ConsoleLogin from unfamiliar user-agents, and any use of the root account (which should almost never appear in normal operations).
Practical guide

How to analyse CloudTrail logs: a practical guide

CloudTrail records almost every API call made in your AWS account: who made it, from where, when, and whether it worked. When something changes unexpectedly, such as a deleted security group, a new access key or an Amazon Connect instance setting that "nobody touched", CloudTrail is where you find out what happened. Raw CloudTrail files are hard to read, though. Each file is gzipped JSON with a Records array that can hold thousands of events. This analyzer parses them in your browser and pulls out the events that matter.

Where to get the logs

  • Event history (console): CloudTrail → Event history keeps 90 days of management events per region at no cost. Filter by event name, user or resource, then use Download events and choose JSON.
  • A trail in S3: trails deliver files to s3://bucket/AWSLogs/<account-id>/CloudTrail/<region>/YYYY/MM/DD/. Download one or more .json.gz files and drop them in. You don't need to unzip them first.
  • CLI: aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=DeleteBucket --max-results 50 returns the same events as JSON you can paste.

What to look at first

  1. Failed calls. Events with an errorCode such as AccessDenied or UnauthorizedOperation show either a permissions problem in an app, or someone probing what they can do. A burst of failures from one identity is worth investigating.
  2. Root user activity. userIdentity.type = Root should be rare. Any root sign-in or API call outside account setup or billing work needs an explanation.
  3. IAM changes. CreateUser, CreateAccessKey, AttachUserPolicy, PutRolePolicy and UpdateAssumeRolePolicy are the classic signs of privilege escalation.
  4. Logging being switched off. StopLogging, DeleteTrail and PutEventSelectors on a trail are high-severity events, because attackers try to remove the record of what they did.
  5. Unusual source IPs or regions. Activity in a region you never use often means a leaked credential is being used to run resources.

Worked example: "who changed our Amazon Connect instance?"

Amazon Connect admin actions are management events in CloudTrail under the event source connect.amazonaws.com. If a queue, routing profile or contact flow changed overnight:

  1. In Event history, filter on Event source = connect.amazonaws.com for the time window, download the results as JSON and load them here.
  2. Look for UpdateContactFlowContent, UpdateQueueHoursOfOperation, UpdateRoutingProfileQueues or UpdateUserRoutingProfile.
  3. userIdentity shows the IAM role or user. For changes made in the Connect admin website, it is typically the role used by the Connect console session. sourceIPAddress and eventTime help you match the change to a person or a pipeline.

Event times are in UTC. Convert them to local time with the Unix Timestamp Converter when you line them up against contact records from the CTR Parser.

Reading an event

  • eventName and eventSource: the API call and the service it belongs to.
  • userIdentity: the type (IAMUser, AssumedRole, Root, AWSService) and the ARN. With assumed roles, the session name after the last / often identifies the actual person or job.
  • requestParameters and responseElements: what was asked for and what came back. Some services redact sensitive values.
  • readOnly: false means the call changed something. Filtering to write events cuts most of the noise.

Good practice for CloudTrail

  • Use an organisation trail that covers all regions and sends logs to a separate, locked-down log archive account.
  • Turn on log file validation so you can prove the files haven't been altered.
  • For long-term searching, query the S3 logs with Athena or CloudTrail Lake instead of downloading files.
  • When you find an over-broad permission, tighten it with the IAM Policy Generator and test it with the Policy Simulator before you deploy it.

Official references

AWS AWS Policy Generator AWS S3 Bucket Policy Validator Connect CloudWatch Log Analyzer AWS Unix Timestamp Converter AWS JSON Formatter AWS AWS Policy Simulator

Related guides on the Kloudmint blog

Guide AWS ME-CENTRAL-1 Recovery: Restore S3 & DynamoDB Guide Fix connect:StartChatContact AccessDenied (IAM)
Runs 100% in your browser. Your files and data never leave your machine. Nothing is uploaded or stored.

Need a hand with your AWS setup?

Get help from an AWS architect who builds and runs contact centre and AI workloads: IAM, data pipelines, Bedrock and cost reviews.

Talk to an architect