A web application is deployed in AWS ECS service. Since last week, new ECS tasks cannot be started. After further troubleshooting, you found that an environment variable used by the Docker containers has been deleted in AWS Systems Manager Parameter Store. As a result, the ECS tasks failed to launch. You need to quickly find out when and how the parameter in Parameter Store was deleted. Which option would you choose?

Answer options:

A.Configure a new AWS Config rule that can check the activities of parameter deletion and report the events to an SNS subscription.
B.Open Event History in AWS CloudTrail. Search for the events “DeleteParameter” and “DeleteParameters” for the last week and check the event details.
C.Create a CloudWatch Event rule for the events “DeleteParameter” and “DeleteParameters”. Trigger an email notification and check the event details in the notification.
D.Search for the parameter in AWS Config resources. Check its Compliance Timeline to see when the parameter resource became non-compliant.

Correct Answer : B
Option A is incorrect because the parameter was already deleted so a new AWS Config rule does not help. The new rule can be used to report the actions that will happen in the future.
Option B is CORRECT because CloudTrail Event History can record the events happening in 90 days. You can search for the “DeleteParameter” or “DeleteParameters” events as below:
Option C is incorrect because this method can report the future events but not the ones that have already happened last week.
Option D is incorrect because in AWS Config resources, you should check the Configuration Timeline instead of the Compliance Timeline.
Reference:
https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DeleteParameter.html,
https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DeleteParameters.html