ApexRetail’s incident response team found that the Security team’s KMS customer managed key was disabled at 03:14 UTC. The company has an organization-level CloudTrail that delivers all management events to an S3 bucket. They must quickly determine which federated user performed the DisableKey API call, the source IP, and whether MFA was used. What is the most efficient approach using existing log data?

The most efficient approach is to query existing CloudTrail logs in S3 using Amazon Athena. CloudTrail logs capture API calls, including the DisableKey event, and contain details like the userIdentity (which includes federated user ARN via sessionIssuer.arn), sourceIPAddress, and mfaAuthenticated status within sessionContext.attributes. Athena allows SQL-like queries directly on S3 data, making it ideal for quickly extracting this specific information from historical logs without needing to ingest data into a new service. Amazon Detective is for threat detection and investigation, not direct querying of specific API calls for immediate forensic details. CloudTrail Lake would require creating a new event data store and ingesting future events, which doesn't help with past incidents. AWS Config tracks resource configuration changes, not API call metadata in this detailed manner.