During an outage, it was observed that a wrong configuration was made to the Amazon EC2 instance by an operations team member. To get more details, the team lead scrutinizes AWS CloudTrail logs to check the user who made the changes & the tool from which these changes were performed. 
Which fields of the AWS CloudTrail Logs can be checked to get these details?

Answer options:

A.Check “userIdentity” & “userAgent” field of AWS CloudTrail logs.
B.Check “userIdentity” & “eventSource” field of AWS CloudTrail logs.
C.Check “requestParameters” & “eventSource” field of AWS CloudTrail logs.
D.Check “requestParameters” & “userAgent” field of AWS CloudTrail logs.

Correct Answer: A
AWS CloudTrail captures actions made by users, roles, and services to AWS resources from AWS Management Console, AWS CLI, AWS SDKs and APIs. AWS CloudTrail Logs can be evaluated to get the required details.
The userIdentity field in logs provides information about the user who made a request to the resource, while userAgent provides information about the tool used in making changes.
Option B is incorrect as the “eventsource” field will have the name of the service to which the request was made.
Option C is incorrect as the “eventsource” field will have the name of the service to which the request was made. The “requestParameters” field consists of the parameters which were sent with the request.
Option D is incorrect as the “requestParameters” field consists of the parameters which were sent with the request.
For more information on AWS CloudTrail Logs, refer to the following URL,
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-record-contents.html