Log All AWS API Calls with CloudTrail
A DevOps engineer needs to ensure that all API calls made to AWS are logged for compliance. The logs must be stored in S3 for at least 7 years. Which AWS service should they use?
Quick Answer
The answer is AWS CloudTrail because it is the only service that records every API call made to your AWS account, capturing details like the identity, source IP, and timestamp, and it can deliver those logs directly to an S3 bucket for long-term storage. This meets the compliance requirement to retain logs for at least 7 years by using S3 lifecycle policies to transition objects to cheaper storage classes like Glacier or to delete them after the specified period. On the AWS Certified DevOps Engineer Professional DOP-C02 exam, this question tests your understanding of governance and audit controls; a common trap is confusing CloudTrail with CloudWatch Logs, which captures application logs rather than API activity. Remember the mnemonic: CloudTrail tracks the trail of API calls, while CloudWatch watches metrics and logs.
⚠ Common exam trap
Candidates often confuse CloudTrail with CloudWatch Logs or AWS Config, thinking that any logging service can capture API calls, but only CloudTrail is designed specifically for auditing AWS API activity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail
AWS CloudTrail is the correct service because it records all API calls made to AWS, including the identity, source IP, and timestamp, and can deliver log files to an S3 bucket for long-term retention. The requirement to store logs for at least 7 years aligns with CloudTrail's ability to integrate with S3 lifecycle policies for archival or deletion after a specified period.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
VPC Flow Logs
Why it's wrong here
VPC Flow Logs capture IP traffic information, not API calls.
- ✗
AWS Config
Why it's wrong here
Config records resource configuration history, not API calls.
- ✗
Amazon CloudWatch Logs
Why it's wrong here
CloudWatch Logs captures log data from applications, not AWS API calls.
- ✓
AWS CloudTrail
Why this is correct
CloudTrail records all AWS API calls and can deliver logs to S3 for long-term retention.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 251-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to centralize logging of all API calls made within their AWS account for auditing. Which service should they use?
easy- A.Amazon S3 access logs
- ✓ B.AWS CloudTrail
- C.VPC Flow Logs
- D.Amazon CloudWatch Logs
Why B: AWS CloudTrail records API calls for auditing. Option A is wrong because Amazon S3 access logs only record HTTP requests to S3 buckets, not all API calls across the account. Option C is wrong because VPC Flow Logs capture network traffic metadata, not API calls. Option D is wrong because Amazon CloudWatch Logs is a service for storing and monitoring log files, but it does not inherently capture API calls.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.