A hospital security team must name the IAM principal that called StopInstances on a production instance yesterday. CPU graphs for that hour look normal. Where should the operator look first?
Select an answer to reveal the explanation.
Short Explanation
CPU graphs tell you the engine was quiet, not who turned the key. You want the API receipt: a CloudTrail management event for StopInstances names the principal. Memory metrics and VPC Flow Logs show performance and network traffic, not who made the call.
Full Explanation
StopInstances is an AWS API call, and CloudTrail management events record the principal, time, source, and request for that call. That is the record that names who stopped the instance. The EC2 CPU graph shows utilization, which the stem says looked normal, and it has no IAM principal. VPC Flow Logs show network accepts and rejects, not control-plane calls. The instance’s memory metric from the CloudWatch agent is also a performance number, not an identity record. Exam caveat: if the trail’s management events were turned off, or the event is older than event history retains, you need the trail’s log in S3 rather than the console’s recent history. Practical check: filter CloudTrail for the event name StopInstances around that time and read the userIdentity block. Event history in the console is enough for a call from yesterday, while a trail to S3 is what you keep when the audit window is longer. Either way, read the identity on the StopInstances event, not a metric dimension. If several people share one role, the trail still shows that role, and you need the source principal or session name to go further.