Exam-style
A reviewer finds a security group allowing inbound access from 0.0.0.0/0 that the approved design restricts to a single corporate address range. Two answers are needed: a record of the security group's configuration over the past ninety days showing when it stopped matching the approved state, and the identity and source IP address of whoever made the change. Which services provide them?
Reveal the answer
B. AWS Config for the configuration history, and AWS CloudTrail for the identity
AWS Config records the configuration of each resource over time and keeps the history, so it answers what the security group looked like at any point and when it stopped matching an approved state; a Config rule can evaluate that state continuously and flag the drift without anyone reviewing it by hand. AWS CloudTrail records the API calls, so it names the principal who called AuthorizeSecurityGroupIngress, the time, and the source IP address; its ninety-day event history covers management events with no trail configured. CloudTrail alone does not answer the first half. A call record is not a configuration history, and rebuilding the state at a given date from raw call records duplicates what Config already stores. CloudWatch handles metrics, logs and alarms, which is behaviour rather than configuration. Security Hub aggregates and correlates findings from other services, Detective investigates behaviour once a finding exists, Inspector scans for software vulnerabilities and unintended network exposure, and GuardDuty detects threats from activity logs; none of them is the record of what a resource was configured as.
Q. What did this resource look like last month, and who changed it?
A. AWS Config for the first, AWS CloudTrail for the second.
Why? Config records configuration and its history; CloudTrail records API calls and the identity behind them. CloudWatch, the third service in the set, records behaviour: metrics, logs and alarms.