PRODUCTION SCENARIO
A security team must show an auditor which IAM principal deleted an Amazon Bedrock guardrail and when the deletion happened.
Which AWS service will meet this requirement?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: AWS CloudTrail
CloudTrail records actions taken by a user, role, or AWS service as events, so it identifies who took which action, on which resource, and when. AWS Config records resource configuration state and its changes, so it shows the guardrail is gone without naming the caller. Amazon CloudWatch collects metrics and application logs, which describe performance rather than API callers. Trusted Advisor checks an account against best practices.