aws-cloudtrail-audit — the nine CloudTrail questions your compliance checklist skips

CloudTrail is the only witness to an incident, and it is configured exactly once, by whoever bootstrapped the account, years before anyone needs it. The day you go looking for who deleted the bucket, you find out the trail was single-region, data events were off, and log file validation was never enabled - so what you have is a story, not evidence.