Find who changed a setting — CloudTrail

Your goal

Trace a surprising account change back to the request that made it.

Why this matters

A security rule changed, and the team needs facts. You will choose an audit record, read the identity and action, and decide which activity needs extra logging.

Words you will use

An audit record describes an action for later review. Management events cover resource settings. Data events cover selected resource-level activity, such as object access.

How to proceed

Read each situation and choose an answer. The lesson explains the result. Try again if needed, then continue through all three decisions and finish the tour.

1. Choose the change record

A network rule was opened yesterday. You want to know which identity changed it and when. Choose the service designed to record AWS account activity.

Where should you begin?

CloudTrail management events.

CloudTrail records supported account activity. Management events help investigate changes to resources. Start with the relevant region, time, and action.

The investigation begins with records of account actions.

Time window + region + event name → matching events

2. Read the evidence

You find a matching event. It includes a time, an action name, and identity information. Choose what to compare before blaming a person.

Which details matter?

Identity, action, affected resource, time, and error details.

An identity may be a role session used by an app or automation. Trace that context before assuming a human made the call. A failed request is different from a successful change.

The team follows the actual request and its identity context.

eventTime + eventName + userIdentity + request details

3. Choose enough coverage

You also want records of reads from a particular S3 bucket. Basic management-event history does not include every object read. Choose what to plan.

What might you need to enable?

Suitable S3 data-event logging and retention.

Select the data events needed for your investigation and choose how long to retain them. Coverage and cost depend on the configuration; do not assume all activity was already recorded.

The logging plan includes the specific data activity the team needs.

Choose event coverage → select resources → set retention

Practice, then check your understanding

In the interactive tour, make each decision before seeing the outcome. Wrong answers receive coaching, and replay gives you a fresh attempt without duplicating earned XP.

Read the official AWS documentation for service behavior and production details.