2.2. Logging and Audit Services

💡 First Principle: Metrics tell you a system is unhealthy; logs tell you what it did. Logs are the raw event record Think of it like a flight recorder versus a cockpit instrument panel: metrics show current altitude and speed (health), whereas logs record every action the pilot took (what happened). Without logs, you can see that a system failed but not why. of everything your system decided — every API call, every HTTP request, every database query. Without logs, you're diagnosing incidents by inference. With logs, you have evidence.

Logs also serve a compliance function. Regulations like SOC2, PCI-DSS, and HIPAA require audit trails of who accessed what and when. CloudTrail answers that question for every AWS API call in your account. These aren't just debugging tools — they're legal records.

The key distinction between CloudWatch Logs (application/system events) and CloudTrail (AWS control plane API calls) trips up many candidates. Think of it this way: CloudWatch Logs captures what your application did; CloudTrail captures what your engineers and services did to AWS infrastructure.