Q: What is AWS CloudTrail and how is it different from CloudWatch?
- CloudTrail — records API calls made to AWS. Who did what, when, from where. "Audit trail." Example: who deleted that S3 bucket? Who cha...
#AWS #Monitoring & CloudWatch #L2 #Cloud #Infrastructure #EC2
🎙️ Candidate Opening & Architectural Context
""AWS reliability requires differentiating between AWS control plane limits and host-level resource exhaustion. When addressing this question, I walk the interviewer through our production incident runbook: isolating the blast radius, checking diagnostic logs and metrics, and applying a safe fix.""
Advertisement
🛠️ Production Runbook & Step-by-Step Resolution
1️⃣
Initial Diagnostics & Root Cause Analysis
CloudTrail logs: Bob assumed the role AdminRole at 3:47 PM and called ec2:TerminateInstances on i-123456.
- CloudTrail — records API calls made to AWS. Who did what, when, from where. "Audit trail." Example: who deleted that S3 bucket? Who changed that Security Group?
- CloudWatch — operational monitoring. Metrics, logs, alarms. How is the system performing right now?
2️⃣
Remediation & Permanent Safeguards
CloudWatch logs: App server error rate is 5.2% for the last 10 minutes. Use CloudTrail for: security investigations, compliance auditing, change tracking. Enable in all regions. Store logs in S3 with immutable retention (S3 Object Lock) for compliance. --- ## 🔵 CI/CD on AWS
💡 The Senior SRE Gold Nugget (Key Architectural Takeaway)
"Pro-Tip: CloudTrail — records API calls made to AWS. Who did what, when, from where. "Audit trail." Example: who deleted that S3 bucket? Wh."
⚡ 60-Second Elevator Pitch Talking Points
- CloudTrail — records API calls made to AWS. Who did what, when, from where. "Audit trail." Exampl...
- CloudWatch — operational monitoring. Metrics, logs, alarms. How is the system performing right now?
Advertisement