Who changed what, when, and from which state to which — CloudTrail's record of every mutating API call and Config's per-resource configuration history, plus, where Change Manager is in use, the change-request executions that carry the approval
The API supplies the facts, but a human judgement against a documented baseline turns them into evidence.
Fetch
$ aws cloudtrail lookup-events --lookup-attributes AttributeKey=ReadOnly,AttributeValue=false --start-time <START_TIME> --end-time 2026-07-31T23:59:59Z --query 'Events[].{Event:EventName,Time:EventTime,User:Username,Source:EventSource,Resources:Resources}'$ aws configservice get-resource-config-history --resource-type AWS::EC2::SecurityGroup --resource-id sg-0123456789abcdef0 --chronological-order Reverse$ aws ssm describe-automation-executions --filters Key=AutomationSubtype,Values=ChangeRequest --query 'AutomationExecutionMetadataList[].{Id:AutomationExecutionId,Document:DocumentName,Status:AutomationExecutionStatus,Mode:Mode,By:ExecutedBy,Start:ExecutionStartTime,End:ExecutionEndTime}'Expected output
An Events list in which each entry names the EventName, EventTime, Username, EventSource and the resources touched, with CloudTrailEvent carrying the full request parameters; a configurationItems list ordered newest-first whose configurationItemCaptureTime and configurationStateId let you diff the resource across the change and whose relationships show what else it touched; and, where Change Manager applies, an AutomationExecutionMetadataList of AutomationSubtype ChangeRequest showing the runbook, Mode, ExecutedBy and the start and end of the workflow.
Map — what it proves
- recipe1
- recipe— an authored recipe collects evidence for this control
- KSI only— a Key Security Indicator reaches it, but no recipe is authored yet
- orphan— no Key Security Indicator reaches it — a person writes it up instead
What else these families can fetch:CM 14/34 →
GovCloud
CloudTrail and AWS Config are available in AWS GovCloud (US); trail, resource, and automation ARNs use partition arn:aws-us-gov. Systems Manager Change Manager is NOT available in the AWS GovCloud (US) Regions — drop the third command there and evidence approvals from your own change-management system instead.
Notes & assertions
CloudTrail and Config prove a change was recorded and is reconstructable — actor, time, parameters, and the before/after configuration state — which is CM-03's record-retention and monitoring half. They do not prove the change was proposed, reviewed and approved before it happened; that decision lives in your CCB or ticketing system and has to be joined by ticket or change id. State the retention limits plainly rather than implying full history: lookup-events reaches back only 90 days and returns management (and Insights) events only, so anything older must be read from the trail's S3 objects or a CloudTrail Lake event data store, and get-resource-config-history honours your Config retention period (30 days minimum, up to 7 years) but each call spans at most 7 days, so a long window needs paging by time. Substitute your real resource type, resource id and time window. Change Manager has also been closed to new customers since 2025-11-07, so treat that command as available only if you were already signed up. Whether the post-change configuration is still compliant is a different question answered by the Config rule recipes.
References
- AWS CLI: cloudtrail lookup-events (90-day lookup window) https://docs.aws.amazon.com/cli/latest/reference/cloudtrail/lookup-events.html
- AWS CLI: configservice get-resource-config-history https://docs.aws.amazon.com/cli/latest/reference/configservice/get-resource-config-history.html
- AWS Systems Manager Change Manager (change templates, approvals, auditing) https://docs.aws.amazon.com/systems-manager/latest/userguide/change-manager.html
- AWS CLI: ssm describe-automation-executions (AutomationSubtype filter) https://docs.aws.amazon.com/cli/latest/reference/ssm/describe-automation-executions.html
- AWS Systems Manager in AWS GovCloud (US) — Change Manager not available https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-ssm.html
This AWS mapping is authored opinion (overlay v3.0.0), versioned separately from the dataset and written against ruleset 2026.07.14.01. The upstream FedRAMP dataset names none of these tools.
The Change Management run (7)
- automatable
- partial — needs judgement
- narrative — no API proves this
Every authored recipe filed under CMT, in the order the plan works them. The mark says how much of the evidence the command produces on its own.
- partialPatch Manager compliance state plus Amazon Inspector scan status and coverage — proving flaws are being found continuously (Inspector enabled and actually covering your resources) and that the fixes landed (per-node missing/failed patch counts and the time of the last scan or install)dailypatch-and-vulnerability-remediationAWS Config · AWS Systems Manager Patch Manager · Amazon Inspector
- partialWho changed what, when, and from which state to which — CloudTrail's record of every mutating API call and Config's per-resource configuration history, plus, where Change Manager is in use, the change-request executions that carry the approvalyou are hereweeklycloudtrail-config-change-historyAWS CloudTrail · AWS Config · AWS Systems Manager Change Manager
- partialConfig compliance results proving the ports you declared unnecessary are not reachable from the internet and the software you declared prohibited is not installed, plus the actual installed-application set a periodic review has to readmonthlyconfig-least-functionalityAWS Config · AWS Systems Manager Inventory · Amazon EC2
- partialEvery running instance built from an image you never approved and every node carrying denylisted software, together with proof that an automated action was configured for those findings and a record of what it did when one firedcontinuousunauthorized-component-detection-and-responseAWS Config · AWS Systems Manager Automation · AWS Systems Manager Inventory · Amazon EC2
- partialThe enforced half of who may change what: the service control policy type actually enabled in the organization root, the customer-authored SCPs and the roots, OUs and accounts each one is attached to, and the permissions boundary carried by every principal your own tagging marks as a change authoritycontinuouschange-authority-restrictions-and-enforcementAWS Organizations · AWS IAM
- partialFor every change that reached the assessed branch, the automated verification that ran against it — which workflows ran, on which commit, and what each concluded — together with the two things that decide whether those runs were a condition of the change or merely adjacent to it: the rule that made the checks required, and the platform's own per-push record of whether that rule held, failed, or was bypassed. The runs alone are activity; the rule and the per-push record are what make them a gate.weeklychange-verification-status-checks-and-run-recordsGitHub Actions · GitHub repository rulesets
- partialThe rule requiring the designated owners of the changed code to approve before it merges, the file that names who those owners are, the platform's own report of whether that file actually parses — and, per change, who approved, on which commit, and when.continuoussecurity-representative-change-approvalGitHub code owners · GitHub repository rulesets · GitHub pull requests