AuditRails vs. AWS CloudTrail and Amazon QLDB
AWS CloudTrail is the closest AWS-native option for audit logging, and Amazon QLDB was, until its discontinuation, the closest AWS-native option for a cryptographically verifiable ledger. Both are worth understanding on their own terms rather than assuming either does what a dedicated compliance audit log does.
| Dimension | AuditRails | AWS CloudTrail / QLDB |
|---|---|---|
| What it logs | Your product's own application-level events, such as logins, data access, and admin actions, via a purpose-built SDK. | CloudTrail logs AWS API calls and account activity across your AWS account. It doesn't see events inside your own application unless you explicitly instrument and forward them. |
| Integrity mechanism | Live per-event SHA-256 hash chain; each new entry's hash depends on the previous one, so any alteration anywhere in the chain is detectable immediately. | SHA-256 file hashes plus hourly digest files signed with SHA-256withRSA: a real and defensible integrity mechanism, but one that verifies a batch of delivered log files after the fact, not each event's position in a live chain. |
| Ledger / immutable-database option | Not applicable; AuditRails is purpose-built as an audit log, not a general-purpose database. | Amazon QLDB offered a cryptographically verifiable ledger database, but AWS fully discontinued QLDB, with support ending July 31, 2025. AWS's suggested migration path, Aurora PostgreSQL, does not include QLDB's built-in cryptographic verifiability. |
| Independent verification | Open-source verifier CLI (github.com/auditrails/verifier) recomputes the chain from an export. | CloudTrail publishes a digest-file validation process via the AWS CLI; there is no equivalent for QLDB now that it's discontinued. |
| Compliance framework mapping | Built-in control citations and evidence bundles for 8 frameworks. | CloudTrail is a general AWS activity log; mapping it to a specific framework's audit-logging control is left entirely to you. |
| Pricing model | Flat monthly plan, from €99.99/mo, plus usage overage, frameworks included. | CloudTrail charges per management or data event delivered: $2.00 per 100,000 management events and $0.10 per 100,000 data or network-activity events at AWS's published rates; QLDB is no longer available to provision. |
Why teams choose AuditRails
Teams choose AuditRails when they need an audit log purpose-built for compliance evidence: live per-event hash chaining, framework-specific control citations, and an independent verifier, without assembling that layer on top of general AWS account activity logs.
When CloudTrail is the right tool
If what you need is a record of who did what inside your AWS account, CloudTrail is the right, AWS-native tool for that, and its digest-file signing is a genuinely solid integrity mechanism for that use case. What it doesn't do is log events from inside your own application, or map that activity to a specific compliance framework's control language, which is a separate layer teams typically still need to build or buy.
Frequently asked questions
Is Amazon QLDB still available?
No. AWS fully discontinued Amazon QLDB, with support ending July 31, 2025. Existing QLDB customers were directed toward Amazon Aurora PostgreSQL as a migration path, which does not carry over QLDB's built-in cryptographic verifiability.
Does AWS CloudTrail provide tamper-evidence?
Yes, in a specific and real way: CloudTrail can produce hourly digest files, each SHA-256 hashed and signed with SHA-256withRSA, that let you validate a batch of delivered log files hasn't been altered since delivery. This is different from a live per-event hash chain; it verifies files after the fact rather than linking each event to the one before it.
Can CloudTrail log my application's audit events?
Not directly. CloudTrail is scoped to AWS API activity and account-level events. To get your own application's user logins, data access, or admin actions into an audit trail, you need to instrument your application directly, which is what an SDK like AuditRails' is for.
What should I use instead of QLDB now?
For a compliance-grade, cryptographically verifiable audit log of your own application's activity, AuditRails' hash-chained logs are a direct alternative to what QLDB provided at the database layer. For general AWS account activity, CloudTrail remains the right tool and is unaffected by QLDB's discontinuation.