Which AWS service will help a company identify the user who deleted an Amazon EC2 instance yesterday?

AWS CloudTrail is the service designed for governance, compliance, and operational and risk auditing of an AWS account. It provides a detailed event history of actions taken within the account, including API calls made through the AWS Management Console, AWS SDKs, and command-line tools. CloudTrail logs capture crucial information such as the identity of the user or service that made the request, the time of the request, the source IP address, and the specific action performed, such as terminating an EC2 instance. This makes it the definitive tool for identifying who performed a specific action.

A. Amazon CloudWatch is a monitoring and observability service for AWS resources and applications. It collects metrics and logs for performance analysis, not for auditing user API activity.

B. AWS Trusted Advisor is an online tool that provides real-time guidance to help you provision your resources following AWS best practices across cost, performance, security, and fault tolerance.

D. Amazon Inspector is an automated vulnerability management service that continuously scans AWS workloads for software vulnerabilities and unintended network exposure. It does not track user actions.

1. AWS CloudTrail User Guide: "What Is AWS CloudTrail?" section states

"CloudTrail is an AWS service that helps you enable governance

compliance

and operational and risk auditing of your AWS account. Actions taken by a user

role

or an AWS service are recorded as events in CloudTrail."

2. AWS CloudTrail User Guide: In the "Viewing events with CloudTrail Event history" section

it details how to find information about events

including "who made the request." This directly addresses the question's requirement.

3. AWS Documentation - Amazon CloudWatch: The "What is Amazon CloudWatch?" page describes it as a service that "collects monitoring and operational data in the form of logs

metrics

and events

" focusing on performance and health

not user auditing.

4. AWS Documentation - AWS Trusted Advisor: The "How AWS Trusted Advisor works" section explains its function is to "inspect your AWS environment and then makes recommendations when opportunities exist to save money

improve system availability and performance

or help close security gaps."