QUESTION 41
Several S3 Buckets have been deleted and a few EC2 instances have been terminated. Which AWS service can you use to determine who took these actions?
AWS CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. With CloudTrail, you can log, continuously monitor, and retain account activity related to actions across your AWS infrastructure. CloudTrail provides event history of your AWS account activity, including actions taken through the AWS Management Console, AWS SDKs, command-line tools, and other AWS services. This event history simplifies security analysis, resource change tracking, and troubleshooting. In addition, you can use CloudTrail to detect unusual activity in your AWS accounts. These capabilities help simplify operational analysis and troubleshooting
Refer to above underlined explanation in Question 41. It says CloudTrail is able to record commands in AWS CLI whereas the video earlier on the topic has a diagram and voice over that explains that it does not provide event history of what happens in the CLI. Please clarify the correct answer.
1 Answers
Yes, whether you’re working through the console or by the cli, you are using an IAM user or role and making API calls, so it gets logged by CloudTrail.