Crisp answer: CloudTrail records API calls — who did what, when, from where. CloudWatch records metrics and logs — what is happening with your resources right now. CloudTrail is the audit log. CloudWatch is the operational monitoring platform.
CloudTrail:
Records: Every API call made to AWS (console, CLI, SDK, services)
Data: Who (principal), what (action), when (timestamp), where (source IP),
which resource, request parameters, response
Retention: 90 days in Event History (free). S3 trail for long-term.
Use for: Security investigations, compliance audits, who-deleted-what,
unusual API activity, IAM access reviews
# View recent API activity
aws cloudtrail lookup-events \
--lookup-attributes AttributeKey=EventName,AttributeValue=DeleteBucket \
--region eu-west-2
# Who assumed a specific role?
aws cloudtrail lookup-events \
--lookup-attributes AttributeKey=ResourceName,AttributeValue=my-role \
--region eu-west-2
# Create a trail to log all regions to S3
aws cloudtrail create-trail \
--name my-audit-trail \
--s3-bucket-name my-cloudtrail-bucket \
--is-multi-region-trail \
--enable-log-file-validation
CloudWatch vs CloudTrail:
| CloudWatch | CloudTrail | |
|---|---|---|
| What | Metrics, logs, alarms | API call history |
| When | Real-time | After the fact |
| Who uses it | Engineers (monitoring) | Security, compliance, audit |
| Retention | Configurable (logs), 15 months (metrics) | 90 days free, S3 for longer |
| Use case | Is my service healthy? | Who changed this config? |
Together:
Use CloudTrail for alerting on suspicious API activity:
# CloudWatch Logs metric filter on CloudTrail to alert on root account usage
aws logs put-metric-filter \
--log-group-name CloudTrail/logs \
--filter-name RootAccountUsage \
--filter-pattern '{$.userIdentity.type = "Root"}' \
--metric-transformations metricName=RootAccountUsage,metricNamespace=Security,metricValue=1
What to say in the interview:
"CloudTrail is the API audit log: every AWS API call recorded with the caller identity, timestamp, source IP, and parameters. CloudWatch is operational monitoring: metrics, logs from running services, and alarms. For security investigations I start with CloudTrail — 'who deleted this resource', 'which role made this change', 'is the root account being used'. For operational issues I start with CloudWatch — 'why is CPU high', 'what errors is Lambda throwing'. I route CloudTrail logs to CloudWatch Logs and set metric filters on things like root account usage and console logins without MFA so I get real-time alerts on security-relevant events."