CloudTrail event history is on by default and shows the last 90 days of management events in a single AWS Region. It does not show data events, and it does not cover your whole organization. For long retention, multiple Regions and accounts, you need a trail or an event data store.
What event history gives you
AWS enables CloudTrail for every account, so event history works from day one. It is a searchable, downloadable and immutable record of management events from the past 90 days, such as creating an IAM user or launching an EC2 instance. It captures actions from the console, the CLI and the SDKs, and viewing it costs nothing.
For a quick question like who deleted this security group yesterday, it is often enough.
Where it stops
AWS lists the limits itself:
- Management events only. Data events, Insights events and network activity events are not shown.
- 90 days. Older activity is gone from this view.
- One Region at a time. Searches return events from a single Region.
- One account. There is no organization-wide view.
- Thin search. You can apply one attribute filter plus a time range.
- Download cap. A single download file holds up to 200,000 events.
Event history is also separate from any trail you create. Changes to a trail do not change what event history shows.
What a trail or event data store adds
A trail or an event data store gives you an ongoing record that you control. AWS points to organization-level trails or data stores to record events across all accounts. CloudTrail Lake event data stores also let you query across multiple attributes, Regions and accounts, and over more event types, including data events.
That moves you from looking things up to actually investigating.
A sensible setup
- Create an organization trail, or an organization event data store, from the management or delegated administrator account.
- Send logs to storage in a separate, tightly controlled account, so an attacker in a workload account cannot erase them.
- Decide on data events deliberately. They add volume and cost, so enable them for sensitive buckets and functions first.
- Test the retrieval path. Pick an event from last month and find it in under ten minutes.
Incident timeline problem
Suppose you learn today that a credential leaked two months ago. Event history reaches back 90 days, so you may still be inside the window, but only for management events and only one Region at a time. If the attacker read objects from a bucket, those reads are data events, which event history never showed. Without a trail that had data events enabled, that evidence does not exist.
Click through it at your own pace, or open it full screen.
Quick check
Is event history enough for a small account?
For casual lookups, yes. For any account with customer data or compliance needs, create a trail or event data store so you keep logs longer than 90 days and capture data events.
Does creating a trail change event history?
No. AWS says event history is separate from your trails and event data stores.
Sources
Last reviewed: 19 October 2026.
