Hands-on emulator lab · 6–10 min
Find who changed a setting — CloudTrail
Create an audit-trail configuration and turn on its logging state.
These actions use an isolated AWS Emulator. It stores API state locally; it does not create paid cloud resources or run the full hosted AWS service.
Your goal
Create an audit-trail configuration and turn on its logging state.
Why this matters
Audit logging has a destination and an on/off state that a team should verify. You will create a trail and turn logging on. The check does not claim a particular event was delivered.
Words you will use
An audit record describes an action for later review. Management events cover resource settings. Data events cover selected resource-level activity, such as object access.
How to proceed
Start a fresh emulator, read each numbered step, and enter the practice settings shown. Run the action, inspect its API receipt, then continue. Finish lab checks the emulator state again before saving your progress.
1. Create the trail destination
Create a practice S3 bucket and a CloudTrail trail pointing at it. A trail describes where audit events should be delivered. This local configuration does not audit a real AWS account.
2. Start logging for the trail
Call StartLogging on the trail you created. This requests a state change. It does not by itself show that any particular event was delivered to the destination bucket.
3. Read the trail status
Get the trail’s status and find IsLogging. The lab checks this stored state. Investigating an actual change would also require finding and reading its delivered event record.
Practice, then check your understanding
Perform the actions yourself and inspect the returned state. Errors keep your settings so you can retry. Starting another lab clears the previous live environment. Earned XP is kept, and signed-in achievements sync to your account. Replay does not award duplicate XP.
Read the official AWS documentation for service behavior and production details.