Question: How do you enable CloudTrail for DynamoDB?

Answer

Configure a CloudTrail trail with DynamoDB data-event selectors to record item-level API activity. Creating a trail that logs only management events does not automatically record every table read and write.

Management events describe control-plane operations such as creating or deleting tables. CloudTrail Event history provides recent management activity automatically. For ongoing retention and item-level auditing:

1. Create or update a trail and choose its logging destination and Region coverage.
2. Include the management events you need.
3. Add data-event selectors for DynamoDB tables, scope them to the relevant table ARNs and choose the required read and write activity.
4. Save the configuration, perform a controlled operation and confirm the expected event is delivered.

Data-event logging has additional costs, so scope it intentionally. Protect the log bucket and encryption keys, define retention and alert on relevant activity. If an organization trail already covers the tables, review that configuration before adding redundant logging.

CloudTrail records caller and API context. It is not a complete before-and-after item history or a replacement for backups. Use DynamoDB Streams for change images and access-control guidance for permissions. Do not assume the standard Event history screen includes data events.

Source: AWS CloudTrail integration.