Your company is standing up a new DynamoDB table for an application and will store the customers` credit card information that have made purchases on your eCommerce store. You have been asked to track the AWS API calls that DynamoDB sends to AWS KMS for data encryption. How will you achieve this?

Answer options:

A.Use CloudWatch logs.
B.Use DynamoDb streams.
C.Use CloudTrail logs.
D.Use CloudWatch metrics.

Answer: C
Option A is incorrect as cloudwatch logs show logs created by DynamoDb but can’t confirm if KMS was used.
Option B is incorrect streams record the values added to the DynamoDb table.
Option C is CORRECT as per AWS documentation, “you can use AWS CloudTrail logs to track the requests that DynamoDB sends to AWS KMS on your behalf. “ CloudTrail is used to audit API calls between AWS services.
Option D is incorrect as no such metrics exist in CloudWatch.
Reference:
https://docs.aws.amazon.com/kms/latest/developerguide/services-dynamodb.html