---
title: "Discussion on \"AWS CloudTrail Basics: Who Did What, When and From Where\" | Hashnode"
description: "Discussion on \"AWS CloudTrail Basics: Who Did What, When and From Where\". This week I locked the root account and set a budget. Now the question that comes after both: when something changes in the account, how do I find out who did it, what they did and when? That is AWS C"
url: "https://hashnode.com/posts/aws-cloudtrail-basics-who-did-what-when-and-from-where/6af0b6af043e2c262ec464bb"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [AWS CloudTrail Basics: Who Did What, When and From Where](https://sishodiarobin.hashnode.dev/aws-cloudtrail-basics-who-did-what-when-and-from-where?utm_source=hashnode&utm_medium=feed)

This week I locked the root account and set a budget. Now the question that comes after both: when something changes in the account, how do I find out who did it, what they did and when? That is AWS C

3d ago · 3 min read · sishodiarobin.hashnode.dev  
Read the article

-   [#aws](https://hashnode.com/tag/aws)
-   [#cloudtrail](https://hashnode.com/tag/cloudtrail)
-   [#120daysofaws](https://hashnode.com/tag/120daysofaws)
-   [#cloudsecurity](https://hashnode.com/tag/cloudsecurity)
-   [#devops](https://hashnode.com/tag/devops)

## Written by

[Robin Sishodia](https://hashnode.com/@Sishodia)

@Sishodia · India

  
[View profile](https://hashnode.com/@Sishodia)

AWS DevOps Engineer – Professional | Salesforce Admin (4x certified) | Writing about Kubernetes, Terraform & CI/CD

I moved from 4+ years in operations into Salesforce administration and AWS Cloud/DevOps, and I write about what I learn while building things. I hold 11 certifications, including AWS Certified DevOps Engineer – Professional, Salesforce Platform Administrator I & II, Platform App Builder, Agentforce Specialist, and GitHub Actions. I'm a Trailhead Double Star Ranger with 250+ badges. Here I post practical guides on Kubernetes, Docker, Terraform, CI/CD and DevSecOps, plus Salesforce DevOps with Copado and GitHub Actions. I'm open to Salesforce Admin, CRM support and DevOps/Cloud roles and can join immediately.

## Responses

Markdown supported · ⌘↵ to post

No responses yet.