An auditor asks: "Show who disabled logging in production last quarter. " You open three accounts, find CloudTrail off in one, logs scattered in local S3 buckets, and AWS Config never enabled in the region where the incident happened. Audit-ready logging is not "turn on CloudTrail somewhere.
Source: [Dev.to](https://dev.to/rufilboss/how-to-build-an-audit-ready-cloudtrail-and-config-baseline-23a6)