You are a Devops Engineer for your company. The company has a number of Cloudformation templates in AWS. There is a concern from the IT Security department and they want to know who all use the Cloudformation stacks in the company’s AWS account. Which of the following can be done to take care of this security concern?

Answer options:

A.Enable Cloudwatch events for each cloudformation stack to track the resource creation events.
B.Enable Cloudtrail logs so that the API calls can be recorded
C.Enable Cloudwatch logs for each cloudformation stack to track the resource creation events.
D.Connect SQS and Cloudformation so that a message is published for each resource created in the Cloudformation stack.

Answer - B
This is given as a best practice in the AWS documentation
AWS CloudTrail tracks anyone making AWS CloudFormation API calls in your AWS account. API calls are logged whenever anyone uses the AWS CloudFormation API, the AWS CloudFormation console, a back-end console, or AWS CloudFormation AWS CLI commands. Enable logging and specify an Amazon S3 bucket to store the logs. That way, if you ever need to, you can audit who made what AWS CloudFormation call in your account
For more information on the best practises , please visit the below URL:
http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/best-practices.html