Management and Governance
RecognitionAWS CloudTrail
Records AWS API and account activity for governance, auditing, and investigation.
Key points
- CloudTrail answers who or what called an AWS API, from where, and when; protect and retain trails according to risk.
Best-known use cases
- Investigate a resource deletion or permission change.
What candidates often confuse it with
- CloudTrail records API activity; CloudWatch monitors operational metrics/logs and Config records resource configuration history.
Key takeaway
Choose CloudTrail when the evidence is an AWS API action.
Related services
- Amazon CloudWatch
- AWS Config
Relevant exam tasks
- D1.1
- D1.3