# Who changed what, when, and from which state to which — CloudTrail's record of every mutating API call and Config's per-resource configuration history, plus, where Change Manager is in use, the change-request executions that carry the approval

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /collect/cloudtrail-config-change-history

Recipe id: `cloudtrail-config-change-history` · cadence weekly · partial

> **Authored opinion.** AWS overlay v3.0.0, written
> against dataset 2026.07.14.01. The upstream
> FedRAMP rules name none of these tools; this mapping is ours.

## What it proves

- KSI `KSI-CMT-LMC`
- KSI `KSI-CMT-RVP`
- KSI `KSI-CMT-RMV`
- KSI `KSI-CMT-VTD`
- control `cm-3`

## Collection

Kind: `cli`

```sh
# lookup-events-false
aws cloudtrail lookup-events --lookup-attributes AttributeKey=ReadOnly,AttributeValue=false --start-time <START_TIME> --end-time 2026-07-31T23:59:59Z --query 'Events[].{Event:EventName,Time:EventTime,User:Username,Source:EventSource,Resources:Resources}'
# get-resource-config-history
aws configservice get-resource-config-history --resource-type AWS::EC2::SecurityGroup --resource-id sg-0123456789abcdef0 --chronological-order Reverse
# describe-automation-executions
aws ssm describe-automation-executions --filters Key=AutomationSubtype,Values=ChangeRequest --query 'AutomationExecutionMetadataList[].{Id:AutomationExecutionId,Document:DocumentName,Status:AutomationExecutionStatus,Mode:Mode,By:ExecutedBy,Start:ExecutionStartTime,End:ExecutionEndTime}'
```

## Expected output

An Events list in which each entry names the EventName, EventTime, Username, EventSource and the resources touched, with CloudTrailEvent carrying the full request parameters; a configurationItems list ordered newest-first whose configurationItemCaptureTime and configurationStateId let you diff the resource across the change and whose relationships show what else it touched; and, where Change Manager applies, an AutomationExecutionMetadataList of AutomationSubtype ChangeRequest showing the runbook, Mode, ExecutedBy and the start and end of the workflow.

## Assertions

_No machine-checkable assertion is authored for this recipe._

## GovCloud

CloudTrail and AWS Config are available in AWS GovCloud (US); trail, resource, and automation ARNs use partition arn:aws-us-gov. Systems Manager Change Manager is NOT available in the AWS GovCloud (US) Regions — drop the third command there and evidence approvals from your own change-management system instead.

## Notes

CloudTrail and Config prove a change was recorded and is reconstructable — actor, time, parameters, and the before/after configuration state — which is CM-03's record-retention and monitoring half. They do not prove the change was proposed, reviewed and approved before it happened; that decision lives in your CCB or ticketing system and has to be joined by ticket or change id. State the retention limits plainly rather than implying full history: lookup-events reaches back only 90 days and returns management (and Insights) events only, so anything older must be read from the trail's S3 objects or a CloudTrail Lake event data store, and get-resource-config-history honours your Config retention period (30 days minimum, up to 7 years) but each call spans at most 7 days, so a long window needs paging by time. Substitute your real resource type, resource id and time window. Change Manager has also been closed to new customers since 2025-11-07, so treat that command as available only if you were already signed up. Whether the post-change configuration is still compliant is a different question answered by the Config rule recipes.

## References

- {"title":"AWS CLI: cloudtrail lookup-events (90-day lookup window)","url":"https://docs.aws.amazon.com/cli/latest/reference/cloudtrail/lookup-events.html"}
- {"title":"AWS CLI: configservice get-resource-config-history","url":"https://docs.aws.amazon.com/cli/latest/reference/configservice/get-resource-config-history.html"}
- {"title":"AWS Systems Manager Change Manager (change templates, approvals, auditing)","url":"https://docs.aws.amazon.com/systems-manager/latest/userguide/change-manager.html"}
- {"title":"AWS CLI: ssm describe-automation-executions (AutomationSubtype filter)","url":"https://docs.aws.amazon.com/cli/latest/reference/ssm/describe-automation-executions.html"}
- {"title":"AWS Systems Manager in AWS GovCloud (US) — Change Manager not available","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-ssm.html"}