A company needs to log and audit any principal that publishes messages to Amazon Simple Notification Service (Amazon SNS) topics and Amazon Simple Queue Service (Amazon SQS) queues. The company…

Amazon CloudWatch Logs captures application and infrastructure logs but does not natively collect SNS/SQS API call metadata or principal identity information needed for auditing who published messages.

AWS CloudTrail with data events enabled for SNS and SQS records every API call (including Publish and SendMessage), capturing the principal identity (IAM user, role, etc.), timestamp, and request metadata, which satisfies the auditing and logging requirement for all principals interacting with these services.

Amazon EventBridge can capture certain service events but does not provide the detailed API-level audit trail of every principal making Publish or SendMessage calls that CloudTrail data events provide.

Configuring VPC endpoints (Interface endpoints) for SNS and SQS ensures traffic stays within the AWS network, and CloudTrail data event records include the vpcEndpointId field when a request traverses a VPC endpoint, allowing verification that all communication used the endpoint rather than the public internet.

The correct field name in CloudTrail logs to identify VPC endpoint usage is vpcEndpointId, not vpcEndpoint; inspecting an incorrect field name would not reliably confirm that traffic used the VPC endpoint.