AWS Interview DropIntermediate TierConcept+25 XP on read
How do you get visibility into what's happening on an EC2 fleet, and who changed what, without SSHing into boxes to find out?
Core Summary
These are two different questions wearing one sentence. CloudWatch answers "what is the fleet doing right now," metrics, logs, alarms. CloudTrail answers "who did what to it," an audit log of every API call. Confusing the two is the most common way this question goes wrong.
Hints
Hint 1: CloudWatch is behavior, CloudTrail is authorship
Hint 2: Default EC2 metrics don't include memory or disk without an agent
Hint 3: CloudTrail logs the API call, not what happened inside the instance