Management and Governance
RecognitionAWS CloudTrail
Service that records AWS account activity and API events for governance, compliance, and operational investigation.
Key points
- CloudTrail event history and trails record supported management and data events.
- The recorded principal, action, resource, time, and error can corroborate an AWS API call.
- CloudTrail is account/API audit evidence, not the primary application log or distributed trace.
Best-known use cases
- Identify which principal changed a configuration.
- Corroborate an AWS API authorization or deployment action.
What candidates often confuse it with
- CloudTrail records AWS API activity; CloudWatch holds application logs, metrics, dashboards, and alarms.
- X-Ray follows an application request path; CloudTrail follows supported AWS API activity.
Key takeaway
Use CloudTrail when the diagnostic question is who called which AWS API, not what internal application code did.
Related services
- Amazon CloudWatch
- AWS X-Ray
- AWS Identity and Access Management (IAM)
Relevant exam tasks
- D4.1 — Assist in a root cause analysis
- 4.1.2 — Interpret application metrics, logs, and traces
- 4.1.7 — Debug service integration issues in applications