You'd still see the activity of that machine in AWS CloudTrail logs. From [1]: "CloudTrail records two types of events: Management events capturing control pla

You'd still see the activity of that machine in AWS CloudTrail logs. From [1]: "CloudTrail records two types of events: Management events capturing control plane actions on resources such as creating or deleting Amazon Simple Storage Service (Amazon S3) buckets, and data events capturing data plane actions within a resource, such as reading or writing an Amazon S3 object. [1] https://aws.amazon.com/cloudtrail/features/ https://aws.amazon.com/cloudtrail/features/