01
Incident timeline
Something broke at 14:10; ask what changed in the hour before and Memtro lists the write events by principal and action, then opens the one that modified the load balancer.
AWS CloudTrail + Memtro
Who changed what in your AWS account, answered from the audit log.
Connect an IAM key with CloudTrail read access and Memtro can search the last 90 days of management events: who ran what action on which resource, every event that touched a resource, a summary of changes in any window, and the full record of one event. Hourly, the changes since the last run become a short memory, with identity, network and deletion changes recorded one by one.
What you can do with AWS CloudTrail in Memtro
Ask in plain English from chat, your editor, a scheduled job or your own agent. The model picks the right AWS CloudTrail tool, reads what it needs, and answers with the source cited.
02
Access review
Ask which IAM users, roles or policies changed this month and who did it; the hourly sync has already recorded each change as an event, so the answer is immediate and sourced.
- Events in a window by action, user, resource, resource type, service or access key
- The full record of one event: request parameters, response, user agent, error
- Change summaries: counts by action, principal, service and resource type, with failures
- The history of one resource over 90 days
- Trails and whether each is logging
- Hourly sync of write activity and sensitive changes as events
Ask it like this
Questions people ask once AWS CloudTrail is connected. In agent mode each one also checks the other systems that know about the same people, companies or identifiers.
- ›Who changed the security group sg-0a1b2c yesterday?
- ›What did the deploy role do between 2pm and 3pm?
- ›Which IAM changes happened this week?
- ›Show the history of the prod-uploads bucket
- ›Are our trails still logging?
Where it fits
Teams that get the most from AWS CloudTrail in Memtro, with the rest of their stack attached.
- EngineeringKeep decisions from evaporatingDecisions, owners and deadlines are extracted from conversations and tool results into a typed, time-aware memory. Corrections supersede old facts instead of piling up next to them.
- ProductHear what customers actually ask forFeature requests are scattered across tickets, call notes, Slack threads and issues. Memtro reads them where they live, links them to the customers who raised them, and remembers which decision closed each one.
- Agent buildersMemory and tools for the agents you buildPoint your own agent at Memtro over the OpenAI-compatible API or MCP and it gets long-term memory, read-only connectors and model routing without you building any of it.
Better together
A record in AWS CloudTrail is rarely the whole story. Connect the systems that hold the rest and the agent cross-references them by default, then remembers what it learned so the next question starts further along.
Also in Engineering and operations
Using something else for the same job, or both? Each connector has its own tools; connect as many as you like.
How to connect
- 01In IAM create a user or role with the AWSCloudTrail_ReadOnlyAccess policy
- 02In Memtro choose AWS CloudTrail, paste the key and set the region (us-east-1 for IAM and other global services)
- 03Memtro lists your trails and reads one recent event to confirm access
Also works from
Chat in the dashboard, the OpenAI-compatible API, scheduled jobs, and any MCP client: Claude Code, OpenCode, Cursor, Claude Desktop. The AWS CloudTrail tools are the same everywhere.
Clients and agents →Questions
- Can Memtro change anything in AWS CloudTrail?
- No. The AWS CloudTrail connector is read-only: every tool reads, searches or lists. Nothing is created, sent, updated or deleted, and the credentials you give it should be read-only too.
- Who can use a AWS CloudTrail connection?
- A personal connection serves only your own requests. A shared connection serves the organisation: everyone, or only the teams an admin chooses. Admins can always add shared connections; other members need the permission.
- Does Memtro store my AWS CloudTrail data?
- Credentials are encrypted at rest. Tool results are cached briefly so agent loops do not repeat identical calls, and the facts the model extracts are saved to your organisation's memory with provenance (system, record and link) so they can be checked and superseded. An hourly sync anchors recently changed AWS CloudTrail records into memory as entities.
- How do I connect AWS CloudTrail?
- IAM access key. In IAM create a user or role with the AWSCloudTrail_ReadOnlyAccess policy.
Connect AWS CloudTrail in a few minutes
Seven-day free trial, then one monthly price per organisation. Connectors, jobs and memory are never metered.