In a governance meeting, leaders ask which service answers operational health questions (metrics and alarms) versus who-did-what API history. Which pairing is correct?
Select an answer to reveal the explanation.
Short Explanation
CloudWatch watches the vital signs — latency, errors, alarms. CloudTrail keeps the paper trail of API calls for who changed what. Flip them and governance meetings get the wrong binder every time.
Full Explanation
Amazon CloudWatch is the operational monitoring service for metrics, logs, and alarms, while AWS CloudTrail is the API activity auditing service. CloudWatch watches vital signs such as latency and errors so operators know when a civic API is unhealthy; CloudTrail keeps the paper trail of API calls for who changed what during a change window that might explain an outage. Flipping those roles — treating CloudWatch as the primary who-did-what API audit log or CloudTrail as the metrics alarm system — breaks both operations and governance meetings. Substituting Artifact or Shield for either half of the pairing likewise misses the question's dual focus on monitoring versus auditing. Exam caveat: municipal landing zones commonly require both services together: alarms for availability and trails for accountability, with protected storage and retention aligned to records policies and legal holds. Operational check: implement CloudWatch alarms on critical SLOs for citizen-facing systems, retain logs appropriately, ensure CloudTrail covers all relevant accounts and Regions, restrict who can disable logging, alert on trail stoppage, and periodically reconcile incident timelines with API events that show configuration changes during the outage window.