Someone created an IAM user and attached AdministratorAccess in the city's AWS account. Which sourcetype holds that API evidence?
Select an answer to reveal the explanation.
Short Explanation
Creating an IAM admin is an API call, and CloudTrail is the AWS API diary. VPC flow sees packets, not AttachUserPolicy. GuardDuty may later shout, but the authoritative who-did-what is CloudTrail.
Full Explanation
CloudTrail management events record AWS control-plane APIs such as CreateUser and AttachUserPolicy. VPC Flow Logs capture network five-tuples and do not contain IAM request payloads, while GuardDuty findings may reference suspicious APIs but are not the primary audit log for a known IAM change. On-prem Windows security is the wrong environment, so API questions belong on CloudTrail.