Security Specialty
AWS CloudTrail vs CloudWatch vs AWS Config: Who Did It, How It Performs, How It Is Configured
CloudTrail records who did what (actions by users, roles and AWS services), CloudWatch monitors how your resources and applications perform with metrics, logs and alarms, and AWS Config records how resources are configured over time and evaluates them against rules.
The three services in one table
| Service | The question it answers | What it does |
|---|---|---|
| AWS CloudTrail | Who did what, and when? | Helps with operational and risk auditing, governance and compliance. Actions taken by a user, role or AWS service, in the console, CLI, SDKs and APIs, are recorded as events. Event history keeps 90 days of management events per Region. |
| Amazon CloudWatch | How are my resources and applications performing? | Monitors AWS resources and the applications you run on AWS in real time. Provides metrics, alarms and dashboards, and collects, stores and queries logs. The CloudWatch agent gathers metrics, logs and traces from EC2 fleets. |
| AWS Config | How is this resource configured, how did it change and is it compliant? | Records resource configuration and relationships and their history. Evaluates configuration with rules, packages rules as conformance packs, supports remediation and aggregates data from multiple accounts and Regions. |
Source: docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html
Sources: What is AWS CloudTrail?, What is Amazon CloudWatch? and What is AWS Config?.
Which one fits the scenario?
| Scenario | Service |
|---|---|
| Find out which user or role made a specific API call | CloudTrail |
| Keep an immutable record of user and API activity for audit and security, for years | CloudTrail Lake (event data stores can keep data up to about 7 or 10 years, depending on the pricing option) |
| Get an alert when a metric crosses a threshold | CloudWatch alarm |
| Search and analyze application and system logs | CloudWatch Logs |
| See which ports a security group allowed on a past date | AWS Config configuration history |
| Flag resources that violate a rule and remediate them | AWS Config rules with remediation |
Things the exam likes to test
- You automatically get CloudTrail Event history when you create your account, and there are no CloudTrail charges for viewing it. It covers the past 90 days of management events in a Region.
- CloudTrail log file integrity validation proves a delivered log file was not modified or deleted; enabling it only delivers digest files, it does not validate by itself. See the detection notes.
- GuardDuty analyzes CloudTrail management events on its own, without you enabling anything. Compare the detection services in GuardDuty vs Inspector vs Macie vs Security Hub.
- AWS Config can aggregate compliance data across accounts and Regions with an aggregator.
These services appear throughout Domain 1: Detection. Practice them with a free practice test.
Frequently asked questions
What is the difference between CloudTrail and CloudWatch?
CloudTrail records who took which actions (an audit trail of API activity), while CloudWatch monitors the performance and health of resources and applications through metrics, logs and alarms.
What does AWS Config do that CloudTrail does not?
AWS Config records how resources are configured and how that changed over time, and evaluates them against rules. CloudTrail records the actions taken.
Is CloudTrail enabled by default?
You automatically have access to the Event history when you create your account. It shows the past 90 days of management events in a Region.
Which service shows what a security group allowed on a past date?
AWS Config, through its recorded configuration history.
Sources
AWS updates its programs and documentation. Check the linked official pages for the latest details before you decide or pay.
Practice for your AWS exam
Free practice tests with instant explanations and spaced repetition. No sign-up.
Keep reading
- Security Specialty
AWS GuardDuty vs Inspector vs Macie vs Security Hub
Compare GuardDuty, Inspector, Macie, Security Hub, Detective and Security Lake in one table, with exam-style scenarios to pick the right one.
3 min read - Security Specialty
AWS Security Specialty Study Plan: A 4-Week Roadmap
A week-by-week SCS-C03 study plan built from the domain weights: what to read, what to practice and how to finish with a timed test.
3 min read - Security Specialty
SCS-C03 In-Scope AWS Services: The Official List
Every AWS service on the Security Specialty exam, grouped by category, plus what is out of scope and the concepts AWS says to know.
2 min read