Service comparisons / AWS CloudTrail vs Amazon CloudWatch vs AWS Config
CloudTrail vs CloudWatch vs AWS Config
CloudTrail records who called which AWS API, CloudWatch watches performance through metrics, logs and alarms, and AWS Config tracks how resources are configured and whether they comply with rules. Which service answers which question.
Last checked against AWS documentation · How we write our content
| Question | AWS CloudTrail | Amazon CloudWatch | AWS Config |
|---|---|---|---|
| Answers | Who did what, when, and from where? | How is it performing, and is anything wrong right now? | What did this resource look like, and does it follow our rules? |
| Records | API calls and console sign-ins (management events; data events if you turn them on) | Metrics, logs, traces and alarms | Configuration changes, kept as a timeline per resource |
| Keeps data | 90 days in Event history; longer in a trail to S3 or CloudTrail Lake | Metrics up to 15 months; logs as long as you set | As long as you set, in its S3 bucket |
| Acts on it | Through EventBridge rules on API events | Alarms trigger SNS, Auto Scaling or EC2 actions | Rules flag noncompliance and can run remediation |
| Example question | Who deleted the S3 bucket? | Alert when CPU is above 80% for 10 minutes | Was this security group open to the internet last Tuesday? |
All three are about seeing what happens in an AWS account, so they often appear together as answer options. Each answers a different question: who, how is it running, and what is it configured as.
How to choose
- Auditing and investigations: CloudTrail. Use an organization trail to collect every account’s events in a central, protected S3 bucket.
- Operational health: CloudWatch. Use metrics and alarms for thresholds, Logs Insights to search logs, and the CloudWatch agent for memory and disk metrics, which EC2 doesn’t send by default.
- Compliance and change history: AWS Config. Examples are “all EBS volumes must be encrypted” or “show me every change to this resource”.
Exam traps
- EC2 memory usage isn’t a default metric. It needs the CloudWatch agent.
- S3 object-level actions (GetObject, PutObject) only appear in CloudTrail if data events are enabled.
- To prove logs weren’t changed, turn on CloudTrail log file validation.
- Config detects drift from rules. Preventing the change in the first place is a job for SCPs or IAM.