# Ensure CloudTrail Trail Has Insights Enabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1788890026712241-ensure-cloudtrail-trail-has-insights-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Cloud](https://support.icompaas.com/support/solutions/c_1788889426924716) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1788889470630116)
- Last updated: 2026-09-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that AWS CloudTrail trails have CloudTrail Insights enabled for management events, so that CloudTrail automatically analyzes normal API call volume patterns and generates Insights events when unusual activity, such as a spike in error rates or a burst of resource provisioning calls, is detected.

**Rationale**

Standard CloudTrail logging records every API call but does not, by itself, highlight anomalous patterns of activity; a security team must otherwise manually build detection logic to identify unusual spikes, such as those that might indicate a compromised credential rapidly provisioning resources or a misconfigured automation looping on failed calls. CloudTrail Insights automatically establishes a baseline of normal account activity and surfaces deviations, providing an additional, low-effort detection capability for anomalous API activity.

**Impact**

-   Provides automated anomaly detection for unusual API call volume or error rate patterns
    
-   Can help surface early indicators of a compromised credential or misconfigured automation
    
-   Incurs additional cost per 100,000 events analyzed for Insights
    

**Default Value**

CloudTrail Insights is disabled by default on newly created and existing trails.

**Pre-Requisites**

-   An existing CloudTrail trail with management event logging enabled
    
-   IAM permissions to update trail Insights configuration (cloudtrail:PutInsightSelectors)
    

**Test Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to AWS CloudTrail > Trails.
    
3.  Select the trail to review.
    
4.  Open the Insights events section of the trail configuration.
    
5.  Verify that Insights events are enabled for API call rate and/or API error rate.
    
6.  If Insights is disabled, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to AWS CloudTrail > Trails and select the trail to update.
    
3.  Select Edit next to the Insights events section (or under General details).
    
4.  Enable CloudTrail Insights events, selecting ApiCallRateInsight and/or ApiErrorRateInsight as appropriate.
    
5.  Save the configuration.
    
6.  Verify Insights events begin appearing under CloudTrail > Insights after sufficient baseline data has been collected and any anomaly occurs.
    

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to AWS CloudTrail > Trails and select the affected trail.
    
3.  Select Edit next to the Insights events section.
    
4.  Disable CloudTrail Insights events.
    
5.  Save the configuration.
    

**Reference**

-   [https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-insights-events-with-cloudtrail.html](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-insights-events-with-cloudtrail.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.