Tech Challenge

An organization's only CloudTrail trail was created with the commands below and never modified afterwards. An attacker steals an IAM user's access key, enumerates the account, adds a second access key for persistence, reads an encrypted SSM parameter, and then downloads every object in the acme-reports bucket. Which of the attacker's actions leaves NO entry in that trail?

aws cloudtrail create-trail --name org-trail --s3-bucket-name acme-ct-logs
aws cloudtrail start-logging --name org-trail
# no event selectors / advanced event selectors were ever configured