AWS Certified Solutions Architect – Associate (SAA-C03)Design Secure ArchitecturesMedium
A security auditor needs to regularly review all API calls made to an AWS account, including who made the call, when, from where, and which resources were affected. This audit trail must be stored securely and be centrally accessible for multiple accounts within an AWS Organization. Which AWS service should be used to meet these requirements?
- AAmazon CloudWatch Logs
- BAWS Config
- CAWS Security Hub
- DAWS CloudTrail
Show answer & explanationAnswer & explanation
Correct answer: D. AWS CloudTrail
AWS CloudTrail records API calls and related events made in your AWS account. It captures details like the identity of the caller, the time of the call, the source IP address, and the affected resources. CloudTrail can be configured to aggregate logs from multiple accounts into a central S3 bucket, fulfilling the secure and centrally accessible audit trail requirement.
Why the other options are wrong
- A. Amazon CloudWatch Logs is a service for monitoring and storing logs from various AWS services and applications, but CloudTrail is the specific service for recording API calls, and CloudWatch Logs would typically store the logs generated by CloudTrail.
- B. AWS Config assesses, audits, and evaluates the configurations of your AWS resources, but it does not record API calls.
- C. AWS Security Hub provides a comprehensive view of your security alerts and security posture across your AWS accounts, but it relies on other services like CloudTrail for raw event data; it doesn't generate the audit trail itself.
AWS CloudTrail
AWS CloudTrail provides a record of actions taken by a user, role, or an AWS service in AWS. It records API calls for your account, detailing who, what, when, and from where.
- Records AWS API calls and related events.
- Provides an audit trail for governance, compliance, and operational auditing.
- Can aggregate logs from multiple accounts into a central S3 bucket.
Memory trick: CloudTrail Tracks Every Action, Centrally.