County auditors must prove which workforce identity changed property-tax rate configuration last quarter across console, API, and application workflows. Which traceability approach best supports that review?
Select an answer to reveal the explanation.
Short Explanation
Auditors want a flight recorder, not a fish story. CloudTrail covers who touched AWS APIs; the app still needs its own 'who changed the rate' log with a real user identity. Glue those trails together and last quarter's mystery edit stops being a ghost story.
Full Explanation
County auditors proving which workforce identity changed property-tax rate configuration last quarter need end-to-end traceability across console, API, and application workflows. Ensuring CloudTrail captures management and relevant data events, and that the application emits user-attributed audit logs, lets investigators reconstruct who changed what and when. That approach works because infrastructure API activity alone may miss in-app configuration edits, while app logs alone miss console/IAM changes—both planes are required. Disabling CloudTrail in production to reduce cost and relying on verbal change tickets fails as non-evidentiary for audit. Logging only successful Cognito logins while omitting application configuration change events fails conceptually: authentication success is not a change ledger. Storing tax-rate edits only in an unsigned spreadsheet emailed to the assessor fails integrity and attribution requirements for public-finance controls. Exam caveat: CloudTrail and app audit logs need immutable storage, retention, and access controls; logging without protection against tampering weakens evidentiary value. Operational check: verify CloudTrail is enabled with appropriate selectors, confirm tax-rate change APIs emit user IDs, perform a controlled rate edit in nonprod, and successfully reconstruct actor/time/value from combined logs for auditors.