How Can the Security Team Trace a Former Employee's Access Key Activity in AWS?

SCS-C03 By islever Editorial Last updated

Design a log analysis solution. Design and implement a logging solution.

Short answer

A Search the identified access key in the AWS CloudTrail console event history, which retains 90 days of API activity with no trail setup.

Question

The Security team believes that a former employee may have gained unauthorized access to AWS resources sometime in the past 3 months by using an identified
access key.
What approach would enable the Security team to find out what the former employee may have done within AWS?
  1. Use the AWS CloudTrail console to search for user activity. Correct Answer
  2. Use the Amazon CloudWatch Logs console to filter CloudTrail data by user.
  3. Use AWS Config to see what actions were taken by the user.
  4. Use Amazon Athena to query CloudTrail logs stored in Amazon S3.

Key Takeaways

The test is whether you know CloudTrail Event History covers exactly 90 days and supports lookup by access key attribute with zero setup — the trap is assuming you must first build an S3 trail and Athena table.

Investigating what an identified access key did over the past three months maps directly to the CloudTrail console's 90-day event history, which is searchable by access key ID without any prior trail configuration. This page confirms why the CloudTrail console (A) is the practical answer over Athena, CloudWatch Logs, or AWS Config.

Common mistake: Choosing Amazon Athena (D) because it is the "real" forensic query tool; Athena only works if a trail is already delivering logs to S3 and tables are defined, which is extra setup the scenario never mentions.

Expert Analysis

Why the Answer Is Correct

CloudTrail Event History retains 90 days of management events per region and the console exposes searchable attributes including Access Key ID, user name, event name, resource type, and source IP. Three months falls inside that window, so the team can paste the identified access key into the Event History search bar and immediately see every API call made with it — no trail, bucket, or table required. This is exactly what the AWS knowledge-center article on searching CloudTrail for activity by IAM access key describes, and it is the fastest path from "we suspect this key" to a concrete list of actions. The former employee's activity is API activity, and CloudTrail is the authoritative record of AWS API activity, which is why A is decisive.

Why the Other Options Are Wrong

CloudWatch Logs (B) only contains CloudTrail data if a trail was explicitly configured to deliver events there, and even then the log stream is not designed for ad-hoc lookups by user or access key without custom metric filters and Insights queries on a JSON payload. AWS Config (C) records resource configuration state and compliance over time; it does not give you a searchable history of "what actions did this principal take", even though it derives the actor from CloudTrail. Amazon Athena (D) is the right tool only after 90 days, when events have aged out of Event History and must be queried from an S3 log archive — and that presupposes a multi-region trail and a defined table, which this scenario does not establish.

Community Comment Notes

josellama2000 points to the CloudTrail event history for exactly this 90-day IAM access key lookup and links the AWS knowledge-center article. learnaws16 quotes the CloudTrail FAQ that nothing needs to be enabled: "visit the AWS CloudTrail console or AWS CLI and begin viewing up to the past 90 days". PeppaPig frames the real distinction well — the console needs no additional setup, whereas the S3 route requires a configured trail, and Kdosec concedes Athena could also query recent events but the question asks what simply enables the investigation. habros summarizes the doctrine neatly: three months means CloudTrail querying, beyond that means CloudTrail plus S3 with Athena.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Anchor on the time window in the stem: anything inside 90 days is CloudTrail Event History, and anything older is an S3 log archive queried with Athena. Also check whether a trail is described — if no trail or S3 bucket is mentioned, tools that depend on stored logs cannot be the answer.

Frequently Asked Questions

Why isn't Amazon Athena the better choice for investigating this access key?

Athena is right only after events age past 90 days into an S3 log archive, and it requires a configured trail plus a table definition — setup the scenario never mentions.

Can AWS Config show which actions a specific user or access key performed?

No. AWS Config tracks resource configuration changes and compliance, not a searchable per-principal history of API calls; CloudTrail Event History is the tool for that.

More SCS-C03 FAQ →

Discussion 50 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 50

  1. josellama2000 👍 33
    Use the AWS CloudTrail event history to identify AWS API activity in the last 90 days for your IAM access key. ref- https://aws.amazon.com/premiumsupport/knowledge-center/cloudtrail-search-for-activity/
  2. newbie2019 👍 11
    Wrong. "sometime in the past 3 months" meaning the logs would be from 0-90 days and then you can find it in CloudTrail logging. If it was older than that, then logs would be stored in S3.
  3. learnaws16 👍 9
    Answer is A. 1st question in CloudTrail FAQ, in Getting Started section. "Q: If I am a new AWS customer or existing AWS customer and don’t have CloudTrail setup, do I need to enable or setup anything to view my account activity? A: No, nothing is required to begin viewing your account activity. You can visit the AWS CloudTrail console or AWS CLI and begin viewing up to the past 90 days of account activity."
  4. Kdosec 👍 5
    The A answer is correct but the question should be added more details to mention that the quickest or easy approach, because with Athena I also can query for this kind of activity within 90 days.
  5. donathon 👍 4
    A The user access within the last 3 months which is within the 90 days CloudTrail event history. B: You will not be able to filter by user in CloudWatch. C: AWS Config does not track actions taken by a particular user D: This is still within 90 days. https://aws.amazon.com/premiumsupport/knowledge-center/cloudtrail-search-for-activity/
Show 25 more comments
  1. PeppaPig 👍 4
    A is correct It's not about the 90 days limit. You can use either console or s3 bucket to query the events in the past 90 days. However in order to use s3 bucket requires that you configure a trail while using console doesn't require any additional setup
  2. viestner 👍 4
    A. Athenea is not the answer, Athenea> 90 dyas
  3. KVK16 👍 3 Answered A
    The key is without any configuration by DEFAULT By Default only CloudTrail is logged A. Paste the Specific Access Key ID in Search bar for Access Key lookup. Other attributes to search in Cloud Trail Events History -Event ID, Source , Resource Name , Resource Type ,Username Athena on Cloudtrail is also good but little time taking - need to create a Athena table and query it A. Best for unusual activity form baseline - Cloud watch insights. B. Config - Resource configuration changes are logged but Access key is not one C. Athena on S3 - Cloudtrail need to be configured to push logs to S3 , after 90days good idea
  4. McBTTF 👍 3
    A. You can use CloudTrail to search event history for the last 90 days. You can use CloudWatch queries to search API history beyond the last 90 days. You can use Athena to query CloudTrail logs over the last 90 days. https://aws.amazon.com/premiumsupport/knowledge-center/view-iam-history/
  5. samar123 👍 3
    Perfect Match is A. Reason 1 : UserName is one of the lookable attribute in event history in CloudTrail. This makes search easier. Reason 2 : CloudTrail has to be Enabled explicitly to log in to S3 buckets.
  6. Haxor 👍 3
    As it says the logs are less than 3 months old, that means they are available to see in CloudTrail directly, so answer is A!
  7. INASR 👍 3
    A is correct , cloud trail event history will give you user`s API activities in the last 3 months.
  8. habros 👍 3 Answered A
    Within 3 months: CloudTrail querying Beyond 3 months: CloudTrail + S3, query using Athena
  9. rctaptap 👍 3
    A is Correct but If the sentence was older than 90 days the answer is D
  10. AnNguyen 👍 3
    Agree. Past 3 month then find on CT, more than 3 months then S3
  11. BillyC 👍 3
    A or D.. For me A make sense
  12. ITGURU51 👍 2
    The Security team can use the AWS CloudTrail console to search for user activity and identify what the former employee may have done within AWS. CloudTrail is a service that records AWS API calls and events for your account and delivers log files to an Amazon S3 bucket that you specify.
  13. aws_learner 👍 2
    A is within 90 days for sure D is older than 90 days Most cost effective way is "A" so that you don't have run Athena query
  14. tipzzz 👍 2
    https://docs.aws.amazon.com/athena/latest/ug/cloudtrail-logs.html
  15. AfricanCloudGuru 👍 2
    Ans (A), Because it stores the log file for the users
  16. RakeshTaninki 👍 2
    A is correct, cloud trail event histroy or trails.
  17. HananS 👍 2
    You are the same guy comenting three times why
  18. exams 👍 2
    A makes sense to me
  19. Dot123 👍 2
    the answer is A
  20. jaysource 👍 2
    A IS THE ANSWER
  21. tomtom2020 👍 2
    Yes, it's "A"
  22. sanjaym 👍 2
    Ans: A 100%
  23. IfyEze 👍 2
    ANSWER IS A
  24. devjava 👍 2
    Ans > A
  25. cloudprincipal 👍 2
    Agreed

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How should a secured S3 CloudFormation template be shared across AWS Organizations?

S-grade

How to enforce MFA for AWS CLI EC2 commands?

S-grade

How Do You Disable a Compromised IAM Identity Center User and Audit Activity?

S-grade

How to Find S3 Buckets with Sensitive Data Using Macie with Least Overhead?

S-grade

Practice All SCS-C03 Questions

Access 86 questions with complete answers and detailed explanations.

View Full SCS-C03 Practice Test →

← Back to SCS-C03 Study Guide