Explanation

AWS CloudTrail is the correct service for tracking user activity and API calls in AWS. Here's why:

• AWS CloudTrail logs all API activity across AWS services, including who performed actions, what actions were performed, when they occurred, and from which IP address
• For EC2 instance terminations, CloudTrail would record:
  • The specific user or role that terminated the instances
  • The exact timestamp of the termination
  • The instance IDs that were terminated
  • The API call used (TerminateInstances)

Why the other options are incorrect:

• A. AWS Trusted Advisor - Provides cost optimization, security, and performance recommendations, not detailed user activity logs
• B. Amazon EC2 instance usage report - Shows billing and usage metrics, not user attribution for specific actions
• C. Amazon CloudWatch - Monitors resource performance and operational health, but doesn't track who performed specific API actions

CloudTrail is specifically designed for governance, compliance, and auditing purposes, making it the ideal service for tracking user activity and API calls across AWS services.