DEA-C01 Question 370
Select 2A data engineering team needs to monitor and log access to an Amazon S3 bucket that stores critical business data. They also want to log access to other AWS services used in their pipeline, including Amazon Redshift and AWS Glue. Which of the following actions should they take to ensure proper logging of access to these services?
- A
Enable S3 Server Access Logging on the bucket to capture object-level access logs.
- B
Enable AWS CloudTrail to log API activity for all AWS services in the account.
- C
Activate Amazon S3 Event Notifications to track read and write operations in the bucket.
- D
Use AWS Config to monitor and capture resource configuration changes.
- E
Set up VPC Flow Logs to capture network traffic accessing AWS services.
Show answer and explanation
Correct answers: A, B
Explanation
To log access to AWS services, enabling S3 Server Access Logging ensures detailed logs for the S3 bucket, while AWS CloudTrail provides comprehensive logging for API activity across all AWS services, including S3, Redshift, and Glue. These two mechanisms together fulfill the requirement for monitoring and logging access to the data pipeline's resources.
- A. Correct.
S3 Server Access Logging provides detailed records about requests made to an S3 bucket, including object-level operations. This is essential for tracking access to critical business data.
- B. Correct.
AWS CloudTrail captures API activity and provides a complete audit trail of actions taken on AWS services, including Amazon S3, Redshift, and Glue. This is critical for monitoring access across the data pipeline.
- C. Incorrect.
Amazon S3 Event Notifications are used to trigger workflows or alerts based on specific bucket events, such as object creation. However, they are not designed to log access activity comprehensively.
- D. Incorrect.
AWS Config is used for monitoring the configuration changes of AWS resources, but it does not log access to services or data operations.
- E. Incorrect.
VPC Flow Logs capture network traffic metadata for resources within a VPC. While useful for analyzing traffic patterns, they do not log specific access activity to AWS services like S3 or Redshift.