Getting and viewing your CloudTrail log files
After you create a trail and configure it to capture the log files you want, you need to be able to find the log files and interpret the information they contain.
CloudTrail delivers your log files to an Amazon S3 bucket that you specify when you create the trail.
CloudTrail typically delivers logs within an average of about 5 minutes of an API call. This time
is not guaranteed. Review the AWS CloudTrail Service
Level Agreement
Note
If you misconfigure your trail (for example, the S3 bucket is unreachable), CloudTrail will attempt to redeliver the log files to your S3 bucket for 30 days, and these attempted-to-deliver events will be subject to standard CloudTrail charges. To avoid charges on a misconfigured trail, you need to delete the trail.