The organization must determine who changed an EC2 setting and when.
It needs an audit trail of account API activity.
Which AWS service is primarily used?
AWS CloudTrail records API activity from the console, CLI, SDKs, and other AWS interfaces for audit and investigation.
Detailed explanation
Inspector manages workload vulnerabilities and exposure rather than API audit records.
Inspector manages workload vulnerabilities and exposure rather than API audit records.
Shield provides DDoS protection and does not record the API audit history.
Shield provides DDoS protection and does not record the API audit history.
CloudWatch supports monitoring and log analysis, but CloudTrail is the primary API audit service.
CloudWatch supports monitoring and log analysis, but CloudTrail is the primary API audit service.
CloudTrail records the identity, time, and operation associated with AWS API activity such as an EC2 change.
CloudTrail records the identity, time, and operation associated with AWS API activity such as an EC2 change.
Check official documentation
Compare the following points with the official documentation.
AWS CloudTrail User GuideのWhat Is AWS CloudTrail?を確認する。
What to confirm
EC2設定変更などのAPIイベントをCloudTrailの証跡として確認できる。
Key points
- CloudTrail
- API event
- Audit trail
Notes
- Environment: AWS公式CloudTrailドキュメントの確認
- Confirm current service capabilities and compliance guidance in the official AWS documentation.
Foundation review
Activity versus performance
CloudTrail records control-plane activity, while CloudWatch focuses on monitoring signals.
Investigation starting point
An API event record can identify the principal, time, and request context for a change.