County auditors must prove which workforce identity changed property-tax rate configuration last quarter across console, API, and application workflows. Which traceability approach best supports that review?
Select an answer to reveal the explanation.
Short Explanation
Auditors want a flight recorder, not a fish story. CloudTrail covers who touched AWS APIs; the app still needs its own 'who changed the rate' log with a real user identity. Glue those trails together and last quarter's mystery edit stops being a ghost story.
Full Explanation
Comprehensive traceability of users and services combines AWS control-plane evidence (CloudTrail) with application-level audit records that attribute business configuration changes to workforce identities. Disabling CloudTrail, logging only authentication events, or relying on informal spreadsheets leaves gaps auditors cannot reconstruct. Continuous security improvement for existing municipal systems includes verifying that both infrastructure and application trails exist, are retained, and can be correlated for sensitive changes such as tax rates.