Search CloudTrail Event history within its account, Region and event limits

Choose the right evidence store before concluding that activity is absent.

Source facts

CloudTrail Event history shows the past ninety days of management events in one account and Region. It excludes data, Insights and network activity events and is separate from trails and event data stores. Its lookup supports one attribute filter plus a time range rather than organization-wide multi-attribute analysis.

Source: AWS Documentation.

Applicability

This guide concerns recent Event history investigations, not the retention and coverage of separately configured audit stores.

DSE recommendation

DSE recommends writing down the account, Region, time zone and expected event type before searching. Use the appropriate retained trail or event data store when the question exceeds Event history scope. Preserve the search criteria with any exported evidence so another investigator can reproduce the lookup. Avoid reporting no activity solely because an object read or older event does not appear here. Escalate an evidence gap to the logging owner with the exact scope needed. Include the actual time reference and query scope in incident handoffs. Ask another investigator to repeat a harmless lookup from those notes, then document the escalation route for a question requiring events outside this view instead of extending its conclusions beyond the evidence.

Verification

Proposed verification: locate an approved recent management action in the correct account and Region, compare its details with the expected operation and test the relevant filter. Document where a data-event or older-history question must be answered instead of treating the Event history screen as a complete audit archive.

Official reference

AWS Documentation. Reviewed October 20, 2026.