AWS Certified AI PractitionerAWS Services for AI/ML and Generative AIHard
A security auditor is reviewing an AWS account where a data scientist is training machine learning models using Amazon SageMaker. The auditor needs to verify that all API calls made to SageMaker, including model creation, training job starts, and endpoint deployments, are logged and can be audited for compliance purposes. Which AWS service should the auditor examine to find these detailed records?
- AAWS CloudTrail
- BAmazon CloudWatch
- CAWS Config
- DAmazon GuardDuty
Show answer & explanationAnswer & explanation
Correct answer: A. AWS CloudTrail
AWS CloudTrail provides a record of actions taken by a user, role, or an AWS service in SageMaker (and other AWS services). These logs include API calls, events, and resource changes, which are essential for security analysis, resource change tracking, and compliance auditing.
Why the other options are wrong
- B. CloudWatch collects monitoring and operational data (logs, metrics, events), but CloudTrail specifically logs API calls for auditing.
- C. AWS Config assesses, audits, and evaluates the configurations of your AWS resources, not individual API call logs.
- D. Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior, not a primary source for auditing legitimate API calls.
AWS CloudTrail
An AWS service that enables governance, compliance, operational auditing, and risk auditing of your AWS account by logging actions taken by a user, role, or an AWS service.
- Records API calls and events.
- Logs actions across AWS services.
- Essential for security analysis and compliance.
- Logs can be stored in S3 and analyzed with other tools.
Memory trick: CloudTrail leaves a trail of every action in the cloud.