Recommended Free Tools
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
AWS Config and AWS CloudTrail solve different parts of the audit problem. Config records the configuration state of supported AWS resources, keeps point-in-time history, and evaluates resources against rules. CloudTrail records account activity—who performed an operation, when it happened, and whether it came from the console, CLI, SDK, API, or an AWS service. Neither service is a complete replacement for the other. Use Config to answer what a resource looked like and whether it complied; use CloudTrail to answer who changed or accessed it. Investigations that need both the action and the resulting state normally use both services, sometimes with CloudTrail Lake for combined queries.
What is the difference between AWS Config and CloudTrail?
AWS Config is a resource-state and compliance service. CloudTrail is an account-activity and audit-event service. Config produces configuration items for recorded resources; CloudTrail produces events for activity in an AWS account and Region.
As an Amazon Associate I earn from qualifying purchases.
| Question you need to answer | Best starting point | What you get |
|---|---|---|
| What settings and relationships does this resource have now? | AWS Config | A point-in-time configuration item for the recorded resource. |
| How did the resource configuration change over time? | AWS Config | Configuration history in the resource timeline, APIs, and delivered history files. |
| Who made an API or console change, and when? | CloudTrail | An activity event containing the identity and operation details. |
| Does the resource meet a required rule or baseline? | AWS Config | Config Rule evaluation and a compliance status. |
| What management activity occurred recently without setting up collection? | CloudTrail Event history | A searchable, downloadable, immutable view of up to 90 days of management events in one Region. |
| How can I correlate an action with the resulting state? | Both services | CloudTrail identifies the action; Config shows the resource state before and after it. |
What does AWS Config record and report?
Config records supported resource types only when recording is enabled for those types. Each configuration item is a point-in-time representation of a resource’s attributes, relationships, and other recorded configuration details. A resource timeline groups those items so you can inspect how the resource changed rather than looking at isolated snapshots.
Configuration history
Config can expose history through the console resource timeline and APIs, and can deliver configuration-history files to an S3 bucket you specify. The useful unit is the resource state: for example, the attributes and relationships that existed when a configuration item was captured. If a resource type was not selected for recording, Config cannot reconstruct its earlier state.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Current inventory versus historical state
Config is appropriate for answering inventory and drift questions such as which resources exist, how they are related, and which settings differ from a desired standard. It is not a complete record of every human or service action that touched the resource. A configuration item may show that a setting changed without identifying the actor who made the API call.
Recording scope matters
- Enable recording for every resource type that matters to the control or investigation.
- Account for Region: Config recording and resource timelines are regional, so a multi-Region estate requires coverage in each relevant Region.
- Plan delivery and retention separately: Config can deliver history files to S3, while the amount retained and analyzed depends on your storage and query design.
What does CloudTrail record?
CloudTrail records account activity as events. Events can represent operations from the AWS Management Console, command-line tools, SDKs, direct APIs, and AWS services acting in your account. An event can identify the principal or service involved, the operation, time, Region, and request or response details available for that event type.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Management, data, Insights, and network activity
CloudTrail distinguishes event categories. Management events cover control-plane operations such as creating, changing, or deleting resources. Data events cover selected resource-level operations, while Insights events identify unusual activity patterns when the feature is configured. Network activity events are a separate category. Collection choices determine which of these appear in a trail or event data store.
Event history is not the same as a trail
The default Event history is available without creating a trail. AWS describes it as a viewable, searchable, downloadable, and immutable record of the past 90 days of management events in an AWS Region. It does not include data events, Insights events, or network activity events. The view is constrained to one account and Region, one attribute filter, and a time range.
For longer retention, multiple accounts or Regions, or additional event categories, configure a CloudTrail trail or an event data store. A trail can continuously deliver events to S3; console-created trails apply across Regions by default. CloudTrail Lake event data stores support broader collection and querying, but their selected pricing option, ingestion, storage, and query use affect the bill.
Does AWS Config show who changed a resource?
Not reliably by itself. Config shows the resulting configuration item and its change history; CloudTrail records the API or console activity that may have caused that change. To identify the actor, operation, and request context, search CloudTrail for the relevant event and then compare its timestamp and resource identifiers with the Config timeline.
Free tools Windows power users keep installed
One-click scans. No signup required.
How the two records line up
- Use Config to identify the resource, the changed property, and the approximate time of the state transition.
- Search CloudTrail in the same account and Region for management events around that time, filtering by the resource identifier or API operation.
- Check the event identity fields to determine whether the caller was a user, role, federated session, or AWS service.
- Compare the request parameters with the before-and-after configuration items. Allow for timing differences; CloudTrail log entries are not guaranteed to be ordered as a strict stack trace.
CloudTrail also records calls made to AWS Config itself. That lets you audit who changed a recorder, rule, delivery setting, or other Config control, while Config documents the state of the resources being evaluated.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
How do Config and CloudTrail differ for reporting?
Config reports on resources and their state; CloudTrail reports on events and activity. The distinction affects dashboards, exports, investigations, and the evidence you can present to an auditor.
| Reporting dimension | AWS Config | CloudTrail |
|---|---|---|
| Primary object | Supported AWS resource and its configuration item | Account activity event |
| Typical question | What is configured, and how did it change? | Who did what, when, and through which AWS activity? |
| History view | Resource timeline and configuration-history files | Event history, trail files, or Lake queries |
| Compliance context | Config Rules and compliance state | Evidence of the calls that changed or evaluated resources |
| Default history window | Depends on recording and the history storage you retain | 90 days of management events in one Region through Event history |
| Coverage dependency | Resource type must be recorded | Event category and resources must be included in the trail or event data store configuration |
| Delivery behavior | Configuration history can be delivered to S3; Config events can be sent to EventBridge on a best-effort basis | Trails deliver selected events to S3; Lake stores selected events for querying |
Which service is better for compliance?
Config is usually the primary service for configuration compliance because Config Rules evaluate recorded resources against requirements. CloudTrail supplies the activity evidence that explains how a compliant resource became noncompliant, or who changed a control.
Config Rules and compliance status
A Config Rule evaluates resources against a condition, such as a required setting or relationship. The current compliance result can be viewed with the rule and resource. This makes Config useful for continuous control monitoring, drift detection, and reporting on a baseline across accounts and Regions.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Recording compliance history
There is an important distinction between current evaluation and historical compliance reporting. Recording AWS::Config::ResourceCompliance enables historical compliance changes to appear in the resource timeline. It is not required merely to view current compliance or run a rule evaluation. If you need to demonstrate when a resource moved from compliant to noncompliant, enable recording for that resource type as well as the underlying resources and retain the resulting history.
Where CloudTrail fits in an audit
CloudTrail can show the API calls that changed a security group, disabled logging, altered an identity policy, or modified a Config rule. It can also show administrative activity against the Config service. Those events strengthen an audit trail, but CloudTrail alone does not provide a complete current-state inventory or a rule-based compliance verdict.
What are the retention and coverage limits?
The most common mistake is treating CloudTrail’s 90-day Event history as a universal CloudTrail retention limit. It is only the default management-event view. Trails and event data stores are separate collection mechanisms with their own scope and retention choices.
CloudTrail limits to plan for
- Event history covers the prior 90 days of management events in one Region.
- It excludes data, Insights, and network activity events.
- Searches are limited to one account and Region, one attribute filter, and a time range.
- Longer-term, multi-account, multi-Region, or specialized collection requires a trail or event data store configured for the needed event types.
- CloudTrail entries are not guaranteed to be ordered, so do not interpret adjacent records as a definitive sequence.
Config limits to plan for
- Only supported resource types that are enabled for recording produce configuration items.
- Missing recording at the time of a change means Config cannot create a historical item for that unrecorded period.
- Configuration history and compliance history are different views; recording
AWS::Config::ResourceComplianceis specifically for historical compliance changes. - EventBridge delivery for Config configuration-item and compliance changes is best effort, so it should not be treated as an infallible archive.
How is AWS Config pricing different from CloudTrail pricing?
There is no single meaningful price for either service. Billing depends on what you record, how often it changes, which Regions and accounts are included, how long you retain data, and whether you query or export it. Exact rates are Region- and feature-dependent and should be checked on the current AWS pricing pages before deployment.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteRank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
| Cost driver | AWS Config | CloudTrail |
|---|---|---|
| What starts collection | Resource types selected for recording and the configuration items they generate | Event categories, accounts, Regions, and resources selected for a trail or event data store |
| Evaluation or processing | Config Rule evaluations and related compliance processing | Ingestion and storage for the selected Lake event-data-store pricing option |
| Storage | Delivered configuration history in S3 and any retained service data | Trail delivery to S3 or event-data-store retention and storage |
| Queries and analysis | API, console, S3, and downstream analytics usage | Lake query and analysis usage, depending on the chosen configuration |
| Free component established in the service documentation | Not stated as a blanket free tier for all Config activity | Viewing Event history has no charge |
Model costs by scenario rather than by product name. A low-change account recording a few resource types has a different Config profile from a large multi-account environment recording many resources and running frequent evaluations. Likewise, a short-lived management-event trail differs from a CloudTrail Lake store that ingests data events and retains them for long-term queries.
How should I choose between Config, CloudTrail, or both?
Start with the evidence your control or incident requires. The matrix below gives a practical first choice.
| Need | Recommended design | Reason |
|---|---|---|
| See current settings and relationships | Config recording for the required resource types | Configuration items describe resource state. |
| Detect drift from a standard | Config Rules plus recording | Rules evaluate configuration and expose compliance. |
| Find who changed a setting yesterday | CloudTrail Event history | The default view covers recent management activity without a trail. |
| Investigate an incident older than 90 days | CloudTrail trail or Lake event data store, if configured | Event history alone will not cover that period. |
| Prove a control stayed compliant over time | Config recording, Config Rules, and ResourceCompliance recording where historical compliance is required | The timeline can show compliance transitions. |
| Correlate an actor with a before-and-after state | Config and CloudTrail together | One supplies state; the other supplies activity and identity. |
| Centralize analysis across event sources | CloudTrail Lake with Config configuration items where supported | Lake can query Config items alongside other event sources. |
How do I implement a reliable Config and CloudTrail evidence trail?
Implement the services as complementary layers rather than turning on every option indiscriminately.
Step 1: Define the questions and scope
List the accounts, Regions, resource types, event categories, and retention period required by your control or incident-response process. Decide whether you need only management events or also data, Insights, or network activity events.
Step 2: Enable Config recording
In each relevant account and Region, enable recording for the supported resource types you must inventory or evaluate. Configure delivery of configuration history to the designated S3 bucket if an external archive is required. Confirm that new configuration items appear for representative resources.
Step 3: Add rules and compliance history where needed
Create Config Rules for the required baseline. If the evidence must show historical compliance transitions in the resource timeline, record AWS::Config::ResourceCompliance in addition to the underlying resources.
Step 4: Select CloudTrail collection
Use Event history for a quick, recent management-activity check. Configure a trail for continuous delivery to S3, or an event data store for longer retention, broader event categories, and Lake queries. Verify that the selected configuration includes every account, Region, and event type in scope.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Step 5: Test the correlation workflow
Make a controlled configuration change in a test resource. Confirm that Config records the new state and that CloudTrail records the API or console operation. Record the timestamps, identifiers, and any delay so investigators know how to reconcile the two sources.
Step 6: Protect and monitor the evidence
Restrict access to the S3 destination, Config history, and CloudTrail stores. Monitor recorder, trail, and event-data-store configuration changes in CloudTrail. Treat EventBridge notifications as operational signals, not as the sole retained copy, because Config describes delivery as best effort.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What common mistakes cause misleading results?
Using Config as an identity audit log
A timeline entry can prove that a configuration state changed, but it may not identify the caller. Pair it with the corresponding CloudTrail event when attribution matters.
Assuming Event history contains every CloudTrail event
Event history is limited to 90 days of management events in one Region. Data events, Insights events, and network activity require the appropriate trail or event-data-store configuration.
Turning on a trail after the incident
CloudTrail cannot retroactively recreate events that were never collected into a trail or event data store. Check collection coverage before an incident, not after it.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Recording too few Config resource types
A rule cannot evaluate an unrecorded resource type, and a timeline cannot show a configuration item that was never captured. Review the recording list whenever you add a new service or compliance control.
Confusing current compliance with historical compliance
Current rule evaluation and historical compliance transitions have different recording requirements. Add AWS::Config::ResourceCompliance when the timeline evidence itself is part of the requirement.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Assuming log order proves causality
CloudTrail states that log entries are not ordered. Use timestamps, request identifiers, resource identifiers, and Config state transitions together instead of treating adjacent events as a guaranteed sequence.
Can CloudTrail Lake query AWS Config data?
Yes, where the relevant Config configuration items are available to the Lake query design. This enables combined analysis of configuration state, compliance information, and account activity rather than switching between unrelated evidence stores.
Lake does not remove the need to configure collection correctly. The resources must be recorded by Config, the required CloudTrail event sources must be included, and retention and query choices must match the investigation or audit period.
Which service should a small AWS account start with?
For a quick answer about a recent administrative change, start with CloudTrail Event history because it is available by default and free to view. For ongoing security posture, inventory, drift detection, or compliance rules, add Config recording for the resource types that matter. As retention, account count, or event coverage grows, move from ad hoc Event history searches to a deliberately scoped trail or Lake event data store.
Frequently Asked Questions
Can AWS Config detect a change immediately?
Config creates configuration items when a recorded resource’s configuration changes, but the service documentation describes event delivery through EventBridge as best effort. Treat the resource timeline and retained history as the authoritative evidence, and design alerting with appropriate delay tolerance.
Does CloudTrail record changes made by AWS services?
CloudTrail events can represent activity performed by AWS services as well as activity from users and tools. Inspect the event identity and source fields to distinguish a service-driven operation from a human or federated-session call.
Do I need a separate CloudTrail trail in every Region?
A console-created trail applies across Regions by default, but your required event scope and account architecture still determine whether additional trails or event data stores are needed. Verify the actual trail configuration rather than assuming that one visible trail covers every audit requirement.
What happens if a resource type is not supported by AWS Config?
Config cannot create configuration items or evaluate that unsupported type with Config Rules. Use the service’s own APIs and CloudTrail activity records for available evidence, and document the coverage limitation in the control design.
Is AWS Config required to use CloudTrail?
No. CloudTrail can collect account activity independently, and its Event history works without Config. Config is needed when you require resource-state history, configuration evaluation, or compliance reporting.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems
