You can now analyze CloudTrail events using natural language in Amazon Q Console, eliminating the need to write SQL or manually parse logs. Simply ask questions about trail configuration, security investigations, or operational troubleshooting and get answers grounded in your actual account activity. This integration works in all AWS commercial regions where Amazon Q Console is available.
Check CloudTrail Configuration and Coverage
Ask Amazon Q Console to verify whether your CloudTrail trails are properly configured across all regions and accounts. You can inquire about gaps in logging coverage, such as missing management events or data events for specific S3 buckets or Lambda functions. The tool examines your trail settings and reports back on whether critical services are being monitored.
Use natural language to confirm which data event sources you are currently tracking, like Amazon S3 object-level API calls or DynamoDB table operations. Amazon Q Console queries your trail configurations and event data stores to list exactly what is being logged, helping you identify blind spots in your audit trail.
Get immediate feedback on whether your trails are logging global services such as IAM, STS, or CloudFront, and whether log file validation is enabled. This helps ensure compliance with security best practices without needing to navigate multiple console pages or read dense documentation.
Investigate Security Events with Plain Language
Ask who accessed a specific IAM role or assumed a particular role in the last 24 hours, and Amazon Q Console will return the principal, timestamp, and source IP from actual CloudTrail logs. This enables rapid response to potential credential misuse or lateral movement attempts.
Query what changes were made to your VPC configuration, such as security group modifications, route table updates, or network ACL changes, over a defined time period. The tool filters CloudTrail events for EC2 and VPC API calls and presents a clear timeline of administrative actions.
Check for unauthorized access attempts by asking about failed console sign-ins, API calls with AccessDenied errors, or unusual patterns from a specific IP address or geographic region, all derived from your real CloudTrail event data.
Troubleshoot Operational Issues Using Conversational Queries
Find out who created or deleted a specific resource, such as an EC2 instance or RDS database, by asking Amazon Q Console to trace the API call history for that resource ID. The response includes the user, role, time, and source of the action, accelerating root cause analysis during incidents.
Identify which API calls are generating throttling errors or validation failures by asking about spikes in specific error codes like RequestLimitExceeded or InvalidParameterValue. Amazon Q Console aggregates CloudTrail events to show frequency and context, helping you adjust application behavior or service limits.
Trace activity from a specific IP address or user agent to understand whether it corresponds to legitimate automation, a compromised credential, or a misconfigured tool, using natural language to filter and summarize relevant CloudTrail entries.
What to do next
To get started, open Amazon Q in the AWS Management Console and begin asking questions about your CloudTrail trails or account activity. Use clear, specific phrasing like 'Show me all S3 delete events in the last week' or 'Who modified the default security group in us-east-1?' For deeper guidance, refer to the AWS CloudTrail documentation on integrating with Amazon Q Console.
FAQ
Do I need to enable any additional settings to use CloudTrail with Amazon Q Console?
No, as long as you have CloudTrail trails configured and Amazon Q Console is available in your region, you can start querying immediately. The integration uses your existing trail data and event data stores.
Can Amazon Q Console access CloudTrail logs from multiple accounts or an organization?
Yes, if you have configured CloudTrail for your organization or have delegated administrator setups, Amazon Q Console can query across accounts based on your permissions and trail configuration.
Is there a cost to using Amazon Q Console for CloudTrail queries?
You pay only for the underlying CloudTrail data storage and any associated event data stores or CloudWatch Logs usage. Amazon Q Console itself does not incur extra charges for querying this data.
Source: Analyze your CloudTrail events using natural language in Amazon Q Console (AWS).
