SAA-C03
Deep Dive
CloudTrail records who did what and when in AWS. Config tracks whether resources comply with compliance rules. CloudWatch collects metrics and logs. All three are a fixture in SAA-C03 for auditing, compliance and detecting unauthorized changes.
Contents
AWS CloudTrail records every call made to the AWS API: who made it, what action it executed, when it happened and from which IP or service. It's the source of truth for answering "who did what in my account?".
Management Events
Control operations: creating/deleting resources, changing IAM policies, modifying security groups. Enabled by default on every trail.
Data Events
Operations on data: S3 GetObject/PutObject, Lambda Invoke, DynamoDB PutItem. Disabled by default — they incur additional cost.
Insight Events
Detects unusual account activity: spikes in API calls, anomalous throttling errors. Requires explicit activation.
Storing and querying logs
Regional or multi-region trail
A trail can cover one region or all of them at once. Logs are delivered to an S3 bucket. Retention in S3 is indefinite — CloudTrail alone only keeps 90 days in the console.
CloudTrail Lake
An alternative to S3 for storing events. Lets you run SQL queries against events directly from the CloudTrail console, without needing Athena.
Log integrity
CloudTrail can enable log file validation to detect whether files have been modified or deleted after being delivered to S3.
CloudTrail is not real-time — there can be up to 15 minutes of delay delivering logs to S3
CloudTrail does not log SSH/RDP access to EC2 instances — that happens at the operating system level, outside the AWS API
Logs in S3 can be protected with S3 Object Lock to prevent anyone from deleting them, even root
A multi-region trail is the best practice — a region without a trail is an audit blind spot
AWS Config records the configuration history of AWS resources and evaluates whether those resources comply with defined compliance rules. The question it answers is: "is the resource in the correct state right now?"
Config Rules — types
AWS Managed Rules
More than 150 rules predefined by AWS. Examples: s3-bucket-public-read-prohibited, encrypted-volumes, rds-instance-public-access-check. Ready to use, no code required.
Custom Rules (Lambda)
Custom evaluation logic implemented in a Lambda function. Useful for compliance rules specific to your company or industry.
Automatic Remediation
Config can trigger an SSM Automation Document when a resource becomes NON_COMPLIANT. Enables automatic correction without manual intervention.
Config Aggregator
A consolidated view of compliance status across multiple accounts and regions. Useful for security teams managing multi-account environments.
CloudTrail vs Config — key difference
CloudTrail = "who did what?" — a history of API calls
Config = "is the resource configured correctly?" — continuous compliance evaluation
Config does not tell you who made the change — for that you need CloudTrail
CloudTrail does not evaluate whether a resource's state complies with a rule — for that you need Config
Config retains configuration history for up to 7 years
Amazon CloudWatch is AWS's centralized observability platform. It collects metrics from every service, centralizes logs and lets you trigger automatic actions when something crosses a threshold.
CloudWatch Metrics
Metrics from all AWS services (CPUUtilization, NetworkIn, DatabaseConnections…). Standard resolution: 1 minute. High-resolution: down to 1 second for custom metrics.
CloudWatch Alarms
Triggers actions when a metric crosses a threshold for N periods. Possible actions: SNS notification, scale an ASG, reboot/recover an EC2 instance.
CloudWatch Logs
Centralizes logs from EC2 (via CloudWatch Agent), Lambda, VPC Flow Logs, CloudTrail, RDS, API Gateway. Structure: Log Groups → Log Streams → Log Events.
Logs Insights and Metric Filters
Logs Insights: queries over stored logs to analyze patterns. Metric Filters: extract a numeric metric from a pattern in the logs (e.g. counting 500 errors).
Exam trap
CloudWatch does not record AWS API calls — that's CloudTrail. CloudWatch collects performance metrics and application/service logs. They are complementary tools, not interchangeable.
VPC Flow Logs capture metadata about network traffic entering and leaving network interfaces (ENIs) within a VPC: source and destination IP, ports, protocol, and whether the traffic was ACCEPT or REJECT.
Key characteristics
Can be enabled at VPC, subnet or individual ENI level
Logs can be sent to CloudWatch Logs or an S3 bucket
They do not capture packet content — only metadata (IP/TCP/UDP headers)
They have no impact on network latency — completely asynchronous
Useful for debugging Security Group and NACL rules: see exactly what traffic is rejected
Let you detect anomalous traffic: port scans, data exfiltration, unexpected communications
Exam trap
VPC Flow Logs do not capture traffic generated by the VPC's DNS (Route 53 Resolver), nor traffic to the instance metadata service (169.254.169.254), nor DHCP traffic.
The exam presents scenarios where you must choose the correct tool. These are the most frequent patterns:
Who deleted the S3 bucket?
CloudTrailRecords the DeleteBucket API call with the user, role, IP and exact timestamp.
Is the S3 bucket blocking public access?
AWS ConfigConfig continuously evaluates s3-bucket-public-read-prohibited and marks the bucket COMPLIANT or NON_COMPLIANT.
Has the instance CPU been at 90% for 30 minutes?
CloudWatchA CloudWatch Alarm on the CPUUtilization metric with a 90% threshold over N consecutive periods.
Which IPs accessed my instance?
VPC Flow LogsThey record the source IP, port and whether the traffic was ACCEPT — exactly what's needed for this analysis.
Who changed my security group rule?
CloudTrailModifying a security group is an API call (AuthorizeSecurityGroupIngress) that CloudTrail records.
Do all my RDS instances have backups enabled?
AWS ConfigThe rds-instance-backup-enabled managed rule evaluates every RDS instance in the account and reports the ones that don't comply.
CloudTrail is the answer when they ask about API auditing
Any "who did X?" scenario, "detect unauthorized changes to IAM/SGs/policies" → CloudTrail. Not CloudWatch, not Config.
Config is the answer when they ask about continuous compliance
If the scenario mentions "automatically detect non-compliant resources", "evaluate configuration", "remediate automatically" → AWS Config with Config Rules and optional Remediation.
CloudWatch is the answer when they ask about metrics, alarms or application logs
CPU, memory (with the agent), Lambda errors, API Gateway latency — these are CloudWatch metrics. To alert on thresholds → CloudWatch Alarms + SNS.
VPC Flow Logs for network traffic and connectivity troubleshooting
If the scenario mentions "diagnose why traffic is being blocked", "detect suspicious traffic to an IP" → VPC Flow Logs, not CloudTrail.
Enable multi-region CloudTrail with log integrity and S3 Object Lock
For a robust audit environment: multi-region trail + log file integrity validation + S3 Object Lock in Compliance mode. This is a secure architecture on the exam.
Did you get this topic?
Test what you just learned
A security team needs to automatically detect when someone disables encryption on an S3 bucket and send a notification. Which combination of services is correct?
Put what you learned to the test with original SAA-C03 exam questions.
Start SAA-C03 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.