When an AWS alert says something changed, start by pinning down what failed and when—not by guessing that the latest deployment caused it. Reconstruct the incident by matching the symptom’s timeline with CloudTrail activity, resource configuration history, deployment records, workload signals, and, when costs changed, billing data. A nearby event is a lead to verify, not proof of cause or intent.
Start with the failure and its timeline
Before searching AWS logs, write down three things: what you expected to happen, what happened instead, and who or what was affected. Note the earliest known symptom, the affected workload or resource, the Region, and whether the problem affects one user or multiple workloads. This helps distinguish a local permissions or resource issue from a wider configuration or service problem.
As an Amazon Associate I earn from qualifying purchases.
Build a short timeline around that onset. Check releases and infrastructure changes, permission edits, scaling, traffic changes, scheduled jobs, secret rotations, and relevant service events. A change that happened just before an alert is worth investigating, but timing alone does not show that it caused the failure. AWS’s Builder Center debugging guide frames the initial questions as what should have happened, what happened instead, and who or what was affected.
Free tools Windows power users keep installed
One-click scans. No signup required.
What changed in AWS? Search CloudTrail first
For recorded management activity, start with CloudTrail Event history in the affected account and Region. AWS documents Event history as a searchable, downloadable, immutable record of the past 90 days of management events in one Region; it is enabled by default. The 90-day window applies to that management-event history—not to every kind of AWS activity or to a consolidated organization-wide view. CloudTrail Event history documentation
#1 Best Overall
How to search Event history
- Open the CloudTrail console in the affected account and Region, then choose Event history.
- Set a time range around the earliest symptom. Search by one available attribute, such as event name, resource, or identity; Event history does not let you combine multiple attribute filters in one search.
- Inspect plausible records for the action, event time, identity, and referenced resources. Compare those details with the timeline rather than treating every nearby event as causal.
- Compare up to five selected events or download results if you need to share or examine the records elsewhere.
Event history covers management events only. It does not show data events, such as certain object-level or function-level activity, and it searches one account and Region at a time rather than aggregating an organization. If the action you need is a data event, or the relevant period is outside Event history’s window, absence from this view does not establish that no action happened.
When Event history is not enough
For ongoing capture, broader scope, or more flexible queries, consider a CloudTrail trail or a CloudTrail Lake event data store. These require appropriate setup and configuration; data events in particular must be selected for collection. Check what was enabled and where events were delivered before relying on a missing record as evidence. AWS guidance on viewing recent management events
Who changed this resource?
CloudTrail can identify the recorded API action and the identity associated with it. Inspect the event’s principal and referenced resources, then compare that identity with deployment automation, operational roles, and the change process. The identity in an event is evidence of which principal made the call; by itself, it does not establish which person initiated it, why it happened, or whether it was intentional.
Recommended Free Tools
For a larger environment, trails and CloudTrail Lake can support ongoing or broader event capture and querying than the single-account, single-Region Event history view. Their value depends on configuration and coverage, so verify that the relevant account, Region, event type, and time period were included.
Rank #3
Compare resource history with the expected configuration
AWS Config can show configuration details, relationships, and changes for supported resource types when recording is enabled. Open the relevant resource’s Config timeline and compare the recorded state with the configuration you expected at the time of the incident. Config coverage is not universal: a resource may be unsupported or recording may not have been active. A missing timeline is therefore a coverage gap, not proof that the resource never changed. AWS Config documentation
If the resource is managed through infrastructure as code, compare its recorded state with the relevant repository and deployment record. A Terraform or OpenTofu plan can help expose drift, but that approach applies only where the resource is actually managed through that workflow. A plan or configuration difference can identify a mismatch; it does not, on its own, establish when or by whom the live change was made.
Was this a deployment or a manual change?
Match the suspected change against deployment records and automation logs. Check the release time, target environment, affected resource, and identity used by the deployment. If a CloudTrail event aligns with a deployment, verify that the deployment actually invoked or changed the resource in question. If no deployment aligns, consider manual activity, scheduled automation, scaling, and other changes in the timeline; do not label an event “manual” merely because you have not found a release record.
Keep observations separate from interpretation. For example: “CloudTrail records a security-group update by this role at 14:03 UTC; the application began timing out at about 14:05 UTC” is a supported observation. “The update caused the outage” is a conclusion that needs corroboration, such as the resulting configuration, affected traffic, or an application error that fits the change.
Best Value
How do I find what caused my AWS bill to go up?
Start with the cost anomaly or bill detail: identify which service, usage dimension, account, and time period changed. Then compare the billing evidence with CloudTrail calls and identities, and with CloudWatch resource metrics or application signals. AWS describes two distinct patterns: usage-driven changes, where resource use rises at a similar unit price, and rate-driven changes, where similar usage costs more because the unit price changed. A rate-driven increase may reflect billing or pricing conditions rather than a new API call, so there may be no person or resource change to find.
AWS announced AI-powered cost investigations for Cost Anomaly Detection on June 9, 2026. AWS says an investigation can be started from an anomaly detail page using Investigate with Amazon Q, through the AWS FinOps Agent, or in an Amazon Q conversation about AWS costs. Its described workflow correlates cost data, CloudTrail calls and IAM principals, and CloudWatch resource metrics, tracing usage-driven changes toward API activity and identities while analyzing rate-driven changes through cost composition. AWS announcement
AWS says the capability is available at no additional charge to customers using Cost Anomaly Detection. Cross-account investigations that query CloudWatch Logs Insights incur standard rates and depend on an organization-wide CloudTrail trail delivered to CloudWatch Logs. AWS says that without this setup, it uses available data and identifies what to enable for fuller coverage. Check AWS’s current availability and requirements before relying on the feature; service details can change. The AWS FinOps Agent product page also describes event-triggered investigation and optional delivery of findings through Jira or Slack. These are AWS product descriptions, not independent performance measurements; an investigation is not a guarantee of a definitive root cause. AWS FinOps Agent
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Use each record for what it can establish
| Evidence source | Useful for | Important limits |
|---|---|---|
| CloudTrail Event history | Recent recorded management events, including action, time, identity, and referenced resources | Past 90 days; one account and Region; no data events; one attribute filter per search |
| CloudTrail trail or Lake event data store | Ongoing capture or broader event queries | Requires setup and appropriate event selection; data-event coverage is not automatic |
| AWS Config | Configuration details, relationships, and resource change history | Only supported resource types, and only when recording is enabled |
| Deployment records and infrastructure-as-code plans | Release context and comparison with intended configuration | Useful only where records exist and the resource is covered by the deployment workflow |
| Cost data and workload telemetry | Whether cost, usage, metrics, or application behavior shifted around the incident | Correlation narrows possibilities but does not by itself prove root cause |
Report what is confirmed—and what is still unknown
Close an investigation with the resource, event, identity, time, and scope that the records actually support. Label the causal explanation as confirmed only when the evidence connects the change to the observed effect. Otherwise, state the leading hypothesis and the evidence needed to test it—for example, a missing deployment record, an uncollected event type, unavailable application telemetry, or a resource not covered by Config.
AWS notes that its cost-investigation capability may identify when available data does not support a definitive root cause. That is a useful standard for incident work generally: a transparent evidence gap is more informative than attributing an incident to the nearest event without proof.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
