Management and Governance
AWS CloudTrail
A service that records AWS account activity and API events for auditing, governance, and security analysis.
Key points
- CloudTrail event history helps identify who or what called an AWS API, when, and from where.
- Trails can deliver events for longer-term retention and analysis.
- CloudTrail records control-plane and supported data events; it is not primarily a performance dashboard.
Best-known use cases
- Investigate who changed or deleted an AWS resource.
- Retain an audit trail of account activity.
What candidates often confuse it with
- CloudTrail records API activity; CloudWatch monitors metrics and logs.
- Config records resource configuration state and change history, which complements CloudTrail activity.
Key Cloud Practitioner takeaway
For the identity and time behind an AWS API action, choose CloudTrail.
Related services
- Amazon CloudWatch
- AWS Config
Relevant exam tasks
- D2.2