Day 3 - Logging, Audit, and Troubleshooting: CloudTrail and Failure Recovery

"What happened?" reconstruction when pipelines stop is half of operations. Today we audit via CloudTrail, systematically debug pipelines, recover from failures, and handle DLQ (dead letter queue).

CloudTrail: Who, When, What

CloudTrail is account API call audit log. Where CloudWatch shows "how system operates" (metrics/logs), CloudTrail shows "who called which operation."

• Management Events: Control plane operations—resource create/modify/delete, IAM changes. Enabled by default.
• Data Events: Data plane operations—S3 object GET/PUT, Lambda Invoke, etc. Large volume; default disabled; selectively enable.
• Insights Events: Auto-detect anomalous API call spikes.