Someone turned off encryption on the municipal campground’s knowledge-base bucket last Tuesday. Which service shows which identity made that API call?
Select an answer to reveal the explanation.
Short Explanation
Think of encryption getting turned off last Tuesday. CloudTrail shows which identity made that API call. Invocation logging is the conversation, not who flipped the switch.
Full Explanation
Encryption turned off on the municipal campground’s knowledge-base bucket last Tuesday is a control-plane change against an AI-related resource. AWS CloudTrail shows which identity made that API call—who, when, from where if available, and which action—so responders can attribute the change and support incident response. Use CloudTrail event history or CloudTrail Lake queries to reconstruct Tuesday’s actor and related API sequence.
Bedrock invocation logging fails by concept for this question: it records prompts and completions for conversations, not who flipped a bucket encryption setting on the control plane. Amazon Quick fails because a business-intelligence chart is not an identity trail for management API calls. A best-practice quiz fails because guidance checklists are not an audit trail of who did what; CloudTrail is the trail, not a quiz or recommendation list.
Exam caveat: CloudTrail must already be enabled with adequate retention before the incident; you cannot reconstruct Tuesday’s actor if logging was off or events already expired. Operational check: query CloudTrail for PutBucketEncryption or related calls around Tuesday, identify the principal, restore encryption immediately, tighten IAM so casual disable is harder, and alert on future public-access or encryption-disabled events for that knowledge-base bucket.