DEA-C01 Question 373
Select 2You are a data engineer managing an AWS environment that processes sensitive customer data. To ensure compliance and auditability, you need to log all access to Amazon S3 buckets and other AWS services in your environment. Which steps should you take to implement logging effectively?
- A
Enable AWS CloudTrail to capture API calls and resource access events across all AWS services.
- B
Use AWS Config to monitor and log the configuration changes of your AWS resources.
- C
Enable Amazon S3 server access logging to track all requests made to your S3 buckets.
- D
Set up VPC Flow Logs to capture IP traffic to and from your S3 buckets.
- E
Use Amazon CloudWatch Logs to directly log API requests to S3 without other services.
Show answer and explanation
Correct answers: A, C
Explanation
To log access to AWS services effectively, you need to enable AWS CloudTrail, which captures API calls and access events across AWS services, and use S3 server access logging specifically for S3 buckets. These tools together provide a comprehensive logging solution for monitoring access and ensuring compliance.
- A. Correct.
Correct. AWS CloudTrail provides a history of API calls and activity across AWS services, including S3. It is essential for auditing and logging access.
- B. Incorrect.
Incorrect. While AWS Config is useful for tracking configuration changes, it does not log access or API calls directly. It focuses on resource compliance and tracking configuration history.
- C. Correct.
Correct. Amazon S3 server access logging provides detailed records of requests made to your S3 buckets, helping you track access patterns and security events.
- D. Incorrect.
Incorrect. VPC Flow Logs capture IP-level traffic within a VPC, but they do not provide detailed application-layer logging of S3 or other AWS service access.
- E. Incorrect.
Incorrect. Amazon CloudWatch Logs is used to collect, store, and monitor log data but does not directly log API requests. It works with CloudTrail to visualize logs.