Implement Logging and Monitoring using AWS CloudTrail and Amazon CloudWatch

Why it matters

3.3.4 and 5.2.6 both depend on keeping CloudTrail’s API audit trail distinct from CloudWatch Logs’ application decisions, and this Lab is where both pipelines exist side by side instead of in prose.

What to practise

Enable CloudTrail logging, deliver log data to CloudWatch, and build an alarm or metric filter from it. Watch which events originate at the API layer and which come from the application code emitting them.

How it fits

For 3.3.4, use the Lab to see CloudTrail’s API events and CloudWatch Logs’ application records as genuinely separate forensic sources, each preserving a different half of an audit trail. For 5.2.6, apply the same CloudWatch Logs pipeline to template-confusion and output-format diagnosis — the Lab’s log-to-alarm path is the mechanism that Bite troubleshoots with.