cloudtrail-and-audit-logging

把云中的 API 调用记下来、保护好并能在事故时用来调查，比如用 AWS CloudTrail 建立可靠的审计日志链路。设定或复查云审计时用，确保日志完整、不能被篡改且易于检索。特别注意的是把日志存放、保留和告警做对，避免关键时刻“看不见”发生了什么。

## Purpose

In the cloud, almost everything is an API call — and the audit log of those calls is how you detect misuse and investigate an incident. If it isn't turned on, isn't complete, or can be deleted by the attacker, you're blind exactly when it matters. This skill covers getting cloud audit logging right, using AWS CloudTrail as the concrete example (Azure Activity Log and GCP Cloud Audit Logs follow the same principles).

## When to use it

Standing up a cloud account, hardening an existing one, or preparing for incident response and compliance. Do it before an incident — reconstructing "who did what" is only possible if the logging was already correct when it happened.

## Procedure