A production instance was rebooted last night. The team needs the IAM principal that called RebootInstances. Nobody is about to change a policy. Which record answers who did it?
Select an answer to reveal the explanation.
Short Explanation
You want the receipt for a call that already happened. CloudTrail has the principal on RebootInstances. The policy simulator rehearses a permission; it does not remember who pressed reboot last night.
Full Explanation
CloudTrail management events record RebootInstances with the principal, time, and source. Event history is enough for last night. The policy simulator evaluates policies you supply; it has no list of past callers. Flow logs show network tuples, not an IAM principal. A status-check graph shows health, not identity. Caveat: if several people assume the same role, the event shows the role and the session name, and you may need that session name to reach a person. Operational check: filter event history on the event name RebootInstances and the instance id, and read userIdentity. Search the last day, the event name, and the instance id. The userIdentity block is either an IAM user, an assumed role, or a federated session. Session tags and the access key id distinguish two people who share a role. The simulator remains the tool for a change you have not made yet, which is not this question. Export the event if the audit needs to keep it past event-history retention. A status-check graph still will not name the caller.