Governance
AWS CloudTrail
Records AWS API calls and account activity for audit and investigation.
Key points
- Records AWS account activity and API calls as events.
- Helps answer who did what, when, from where, and against which resource.
- Supports security auditing, operational troubleshooting, and compliance evidence.
- Can deliver events to storage and monitoring destinations for retention and analysis.
- Applies to AWS service activity, including activity around AI and ML services.
When to use it
- Choose CloudTrail when the question asks for an audit trail of AWS API activity.
- Use it to investigate unauthorized changes, model endpoint changes, or IAM activity.
- Use it for compliance evidence showing administrative actions over time.
Exam tips
- CloudTrail records API activity; CloudWatch focuses on metrics, logs, alarms, and operational monitoring.
- Bedrock model invocation logging is separate from CloudTrail API event logging.
- CloudTrail does not enforce permissions; IAM policies enforce permissions.
- For governance questions, CloudTrail is often the audit and accountability answer.