How to Alert on Specific API Calls Using CloudTrail and CloudWatch
A company is using AWS CloudTrail to monitor API activity in its AWS account. The security team needs to be alerted when unauthorized API calls are made to delete Amazon S3 buckets. Which TWO steps should the security team take to meet this requirement? (Choose TWO.)
Quick Answer
Both correct actions here rely on the same underlying mechanism: CloudTrail records every DeleteBucket API call, and that recorded event can be matched by a rule that then triggers an SNS notification, but there are two valid technical paths to get there. One path routes CloudTrail logs into CloudWatch Logs, defines a metric filter that counts occurrences of the DeleteBucket call, and attaches an alarm to that metric that fires an SNS notification once the threshold is crossed. The other path uses Amazon CloudWatch Events, now called Amazon EventBridge, to match the DeleteBucket API call directly as an event from CloudTrail and trigger the SNS notification immediately, without needing an intermediate metric filter or alarm at all. The distinction worth internalizing is that a metric-filter-and-alarm approach is built for counting occurrences over time and alerting on thresholds, while an EventBridge rule is built for reacting to a specific event the instant it happens, and AWS security exams frequently present both as valid but structurally different ways to alert on a specific API call. When a question asks for TWO ways to alert on a specific CloudTrail-logged action, expect one answer to route through CloudWatch Logs metric filters and alarms and the other to route through EventBridge event pattern matching, since these represent the two standard patterns for turning a logged API call into a notification.
⚠ Common exam trap
Candidates often confuse AWS Config (which evaluates resource configurations) with CloudTrail (which records API activity), or think VPC Flow Logs can capture API-level events instead of network flows.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure CloudTrail to deliver logs to Amazon CloudWatch Logs and create a metric filter for the DeleteBucket API call.
Option D is correct because CloudTrail can be configured to deliver management event logs to an Amazon CloudWatch Logs log group, where a metric filter can be created to match the DeleteBucket API call (for example, filtering on eventName = DeleteBucket and errorCode = AccessDenied), and a CloudWatch alarm on that metric can then trigger an SNS notification to alert the security team. Option E is correct because CloudWatch Events (now Amazon EventBridge) can match CloudTrail API activity by event pattern, such as {"eventSource":"s3.amazonaws.com","eventName":"DeleteBucket"}, and route the matching event directly to an Amazon SNS topic to notify the team. Option A is not correct because VPC Flow Logs capture IP traffic metadata at the ENI level, not API calls, so they cannot identify DeleteBucket events. Option B is not correct because a CloudTrail trail does not 'monitor CloudWatch Logs'; the correct direction is CloudTrail delivering logs to CloudWatch Logs, and a trail alone does not generate alerts. Option C is not correct because AWS Config rules evaluate resource configuration compliance and cannot detect or alert on individual DeleteBucket API calls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable Amazon VPC Flow Logs to capture API calls and use Amazon Athena to query for DeleteBucket events.
Why it's wrong here
VPC Flow Logs capture IP traffic metadata at the elastic network interface, not CloudTrail API events such as DeleteBucket, so Athena would have no event names to query. It is tempting because flow logs genuinely support network forensics and traffic analysis, where identifying suspicious connections or rejected packets is the actual goal.
- ✗
Create an AWS CloudTrail trail that monitors Amazon CloudWatch Logs for DeleteBucket API calls.
Why it's wrong here
CloudTrail trails deliver events to S3 and CloudWatch Logs; they cannot monitor CloudWatch Logs for DeleteBucket calls, so no alert is generated. It is tempting because a trail is genuinely required to capture management events such as DeleteBucket, but the trail's role is delivery, not detection — the metric filter and alarm perform that.
- ✗
Create an AWS Config rule to detect DeleteBucket API calls and send an SNS notification.
Why it's wrong here
AWS Config rules are for resource configuration compliance, not real-time API call alerts.
- ✓
Configure CloudTrail to deliver logs to Amazon CloudWatch Logs and create a metric filter for the DeleteBucket API call.
Why this is correct
CloudTrail delivers API activity to CloudWatch Logs, where a metric filter counts DeleteBucket events and drives an alarm. This satisfies the requirement to detect unauthorised delete calls, since CloudTrail alone records but does not alert.
- ✓
Create an Amazon CloudWatch Events rule that matches the DeleteBucket API call and triggers an Amazon SNS notification.
Why this is correct
A CloudWatch Events (EventBridge) rule matching the DeleteBucket API call captures the specific management event from CloudTrail, then routes it to an Amazon SNS topic for immediate alerting. This satisfies the requirement to be alerted on unauthorised S3 bucket deletion attempts without building custom log-parsing infrastructure.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 1,205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security engineer needs to monitor AWS account activity for suspicious API calls and receive alerts. Which AWS service should the engineer use to meet this requirement?
easy- A.VPC Flow Logs
- B.AWS Config with AWS Config Rules
- ✓ C.AWS CloudTrail with CloudWatch Alarms
- D.Amazon GuardDuty
Why C: AWS CloudTrail records all API calls made to the AWS environment, providing a detailed audit trail of account activity. By sending these logs to Amazon CloudWatch, you can create metric filters that match suspicious API call patterns and trigger CloudWatch Alarms to send notifications via SNS. This combination directly meets the requirement to monitor and alert on specific API calls.
Variation 2. A company wants to monitor AWS account activity and receive real-time notifications for specific API calls. Which TWO services should the company use together? (Choose TWO.)
easy- A.Amazon CloudWatch Logs
- ✓ B.Amazon CloudWatch Events (Amazon EventBridge)
- C.AWS Config
- D.Amazon Simple Notification Service (SNS)
- ✓ E.AWS CloudTrail
Why B: AWS CloudTrail (E) is correct because it records API activity in the account as management and data events, providing the raw audit trail of specific API calls that the company needs to monitor. Amazon CloudWatch Events, now Amazon EventBridge (B), is correct because it can match those events against rules (for example, by event source, event name, or API call) and route them in near real time to targets such as SNS, Lambda, or SQS for notification. Together, CloudTrail supplies the API call events and EventBridge evaluates them against rules to trigger real-time notifications. Amazon CloudWatch Logs (A) stores and queries log data but does not by itself capture API calls or deliver event-driven notifications. AWS Config (C) evaluates resource configuration compliance and records configuration changes, not API call activity. Amazon SNS (D) is a notification delivery service, but it is a target rather than the event-matching service, so it is not one of the two services that together detect and route the API call events.
Variation 3. A security engineer is responsible for monitoring AWS account activity. The engineer needs to receive real-time notifications when specific API calls are made, such as 'DeleteTrail' or 'UpdateTrail'. The engineer wants to use AWS services to achieve this with minimal latency. Which combination of services should the engineer use?
easy- A.CloudTrail -> Amazon EventBridge -> Amazon SNS
- B.CloudTrail -> Amazon S3 -> S3 event notification -> AWS Lambda -> Amazon SNS
- C.CloudTrail -> CloudWatch Logs -> CloudWatch Logs subscription filter -> AWS Lambda -> Amazon SNS
- ✓ D.CloudTrail -> CloudWatch Logs -> CloudWatch metric filter -> CloudWatch alarm -> Amazon SNS
Why D: The correct solution is to send CloudTrail logs to CloudWatch Logs, create a metric filter to match the specific API calls (e.g., 'DeleteTrail', 'UpdateTrail'), and set up a CloudWatch alarm on that metric that publishes to an SNS topic. This provides near-real-time alerts. Option D is correct. Option A is incorrect because while CloudTrail can send events to EventBridge, the event delivery is not as immediate as CloudWatch Logs metric filter approach for this use case. Option B is incorrect because S3 event notifications are for object-level events and not suitable for monitoring CloudTrail API calls. Option C is incorrect because CloudWatch Logs subscription filters are for streaming logs to other destinations, not for directly triggering alarms.
Variation 4. A company wants to detect and alert on unauthorized API calls in their AWS account. Which AWS service can provide real-time notifications when specific API calls are made?
easy- A.AWS Config
- ✓ B.Amazon CloudWatch Events (EventBridge)
- C.Amazon GuardDuty
- D.AWS Trusted Advisor
Why B: Amazon CloudWatch Events (now part of Amazon EventBridge) can capture real-time API calls made to AWS services by using a rule that matches specific API calls via CloudTrail integration. When a matching API call occurs, EventBridge can trigger a target such as an SNS topic or Lambda function to send a notification, enabling immediate alerting on unauthorized API calls.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.