[DEVELOPER] CloudTrail

Question 1

What is AWS CloudTrail?

Answer 1

A service that provides a history of AWS API calls for your account.

enables governance, compliance, operational auditing, and risk auditing of your AWS environment.

Question 2

What are the three categories of events recorded by CloudTrail?

Answer 2

1. Management Events (Control Plane)
2. Data Events (Data Plane)
3. Insight Events (Automated analysis of other events)

Question 3

In CloudTrail,

What are Management Events?

Answer 3

API calls related to resource management

Think control plane

Enabled by default.

e.g., RunInstance for EC2, CreateBucket for S3, AttachRolePolicy for IAM).

Question 4

In CloudTrail

What are Data Events?

Answer 4

Events related to data access/usage on a resource

Think data plane

Disabled by default (must be explicitly enabled).

(e.g., S3 object-level APIs like GetObject, Lambda function execution).

Question 5

What is the default retention period for CloudTrail event history in the console?

Answer 5

90 days (Management Events only).

Question 6

Where must you store CloudTrail logs for long-term retention and analysis beyond the default retention period?

Answer 6

An S3 bucket.

Question 7

How can you ensure the integrity and non-repudiation of CloudTrail logs in S3?

Answer 7

Enable file integrity validation on the trail.

using hashing and digital signatures

Question 8

How do you get a single, consolidated view of all API activity across all AWS Regions and all accounts in an AWS Organization?

Answer 8

Configure a multi-region trail and enable it for the entire AWS Organization (using Organizations).

Question 9

Which AWS service is best used to query and analyze CloudTrail logs stored in the S3 bucket?

Answer 9

Amazon Athena (or Amazon QuickSight for visualization).

Question 10

If you disable CloudTrail, will existing S3 CloudTrail logs be deleted?

Answer 10

No

Question 11

A developer needs to track the history of configuration changes (e.g., security group modifications) for an EC2 instance for auditing and compliance. Which AWS service should be used?

Answer 11

AWS Config

CloudTrail records API calls (who did what, when) but doesn’t track configuration changes over time