When something changes in your AWS account and nobody admits to touching it, CloudTrail is how you find out who did what, and when. The catch is that it only helps if you set it up before you need it.
Environment variables aren't unsafe by nature. The real question is where the secret sits in plain text, who can read it, and whether you could rotate it today without an outage.
Security Groups and NACLs both filter traffic, which is exactly why people confuse them. The difference that actually matters isn't what they block — it's how they remember.
