After a suspicious IAM policy change in a municipal AWS account, auditors ask who called which AWS API and when. Which service provides that account API activity audit trail?
Select an answer to reveal the explanation.
Short Explanation
When someone rearranges the keys in city hall overnight, you want the visitor log — CloudTrail is that visitor log for AWS API calls. CloudWatch alarms watch health; Inspector looks for vulnerabilities; Shield fights floods. For who-did-what on the control plane, start with CloudTrail.
Full Explanation
AWS CloudTrail records API activity in an AWS account, capturing details that help answer who performed which actions and when. That audit trail supports security investigations and compliance reviews after unexpected changes. CloudWatch focuses on operational metrics and alarms, Inspector assesses vulnerabilities, and Shield provides DDoS protection — none replaces CloudTrail for API auditing.