A company uses an external identity provider (IdP) for federation into multiple AWS accounts. A security engineer must quickly determine which federated user terminated a production Amazon EC2 instance one week ago. What is the fastest way to identify the user?

The fastest way to identify the user is to leverage the CloudTrail console's event history. First, filter for the TerminateInstances event. This will show the specific API call and the userIdentity details, including the assumed IAM role. Since the user federated via an external IdP, they would have used AssumeRoleWithSAML (or AssumeRoleWithWebIdentity for other IdPs) to get temporary credentials for that role. By finding the AssumeRoleWithSAML event for the identified role around the same time, you can pinpoint the userName of the federated user. Reviewing S3 logs directly or using Athena would be slower as it involves querying raw logs, which is less efficient for a quick lookup than the CloudTrail console's built-in filtering. IAM Access Advisor shows last access times for services/actions, not specific API calls or user identities, making it unsuitable for this task.