# CloudTrail Production Checklist (July 2026)

Event History (90-day management events) ≠ forensic audit trail.

## Trail / Lake

- [ ] Org multi-region trail → Log Archive account S3
- [ ] `EnableLogFileValidation: true` + periodic digest verify
- [ ] SSE-KMS with customer-managed CMK (not only aws/cloudtrail)
- [ ] Data events for sensitive S3 / KMS / Lambda as needed
- [ ] CloudTrail Lake EDS for SQL investigations (retention up to years — set intentionally)
- [ ] Optional: Athena zero-ETL against Lake for joins with other datasets

## Guardrails

- [ ] SCP deny StopLogging / DeleteTrail / UpdateTrail outside break-glass
- [ ] Bucket: TLS-only, SSE-KMS required on PutObject
- [ ] Alert on trail stop / validation failure

## Counter-case

Management-only trails are blind to `GetObject` exfiltration — enable data events where PHI/PII lives.