I assess audit logging through AWS CloudTrail as having all our event history and all the API calls made to AWS. We can search using filters, but it's a bit messy. To improve this, we can create a trail for specific services and store the logs in an S3 bucket. From there, we can export it to CloudWatch or anywhere we want for analysis. AWS Key Management Service is used to encrypt data at rest, and we have gone through AWS Key Management Service in detail. I leverage the bring your own key feature from AWS Key Management Service. Customers can upload their keys through either the CLI or the portal. Automatic key rotation feature significantly helps with compliance. Admins just have to specify how often they require rotation, with a minimum of seven days, up to whatever frequency they need; 365 days is the standard, or they can opt for more frequent rotation. Automatic rotation is one of the very cool features.
