CloudGuild · Blog · Cheat sheets · Lessons · Certifications
AWS CloudTrail & AWS Config — Monitoring and Compliance: When to Use What
Understand when to choose AWS CloudTrail or AWS Config for monitoring and compliance, plus how the exam tests your knowledge.
In the cloud, understanding your resources is key. AWS CloudTrail and AWS Config serve different purposes in monitoring and compliance. Choosing the right service can make a significant difference in your AWS environment.
When to Choose AWS CloudTrail
- Track User Activity: CloudTrail logs API calls, making it the go-to for tracking user actions and interactions with AWS services.
- Governance and Compliance: Use CloudTrail for operational auditing. It provides insights into user activity, which is crucial for compliance audits.
When to Choose AWS Config
- Configuration Management: Config assesses and audits the configurations of your AWS resources. It’s essential for ensuring compliance with internal policies.
- Compliance Tracking: Use AWS Config to monitor resource configurations over time, helping you meet regulatory standards.
Comparison Table
| Feature | AWS CloudTrail | AWS Config |
|---|---|---|
| Purpose | Logs API calls | Tracks resource configurations |
| Data Retention | 90 days (default) | Configurable, but not indefinite |
| Real-Time Monitoring | No (has a delay) | Yes (immediate configuration changes) |
| Compliance | Auditing user actions | Compliance with configuration standards |
| Multi-Region Support | Yes (enable multi-region trails) | Yes (track configurations across regions) |
Key Architectural Decisions
- Choose CloudTrail for a detailed event history of user activity. This is crucial for operational audits.
- Opt for AWS Config when you need to maintain a history of configuration changes and assess compliance.
- Enable Multi-Region Trails in CloudTrail to ensure that all user activity is logged across your AWS regions. This provides a comprehensive view of actions taken in your account.
- Utilize Config Rules to automatically evaluate resource configurations against best practices or compliance standards, enhancing your governance framework.
Gotchas & Exam Traps
- Delay in CloudTrail Logs: Remember that CloudTrail logs are not delivered in real-time. This could impact auditing if immediate access is required.
- Retention of AWS Config Data: Config does not store historical configuration data indefinitely. Plan your retention strategy according to compliance needs.
How the Exam Tests This
- Scenario-Based Questions: Expect questions that present a scenario where you need to choose between CloudTrail and Config based on specific requirements.
- Feature Identification: Questions may ask you to identify which service is best for certain tasks, such as tracking user actions or ensuring configuration compliance.
- Best Practices: Be prepared for questions regarding best practices, such as enabling multi-region logging or setting up Config Rules.
The Rule to Remember
Choose AWS CloudTrail for user activity tracking and AWS Config for configuration compliance.
For hands-on practice, Take the free SAA-C03 mock exam.