DEA-C01 Question 520
Select 2You are a data engineer tasked with ensuring compliance and auditing for an AWS-based data pipeline. You need to log access to the S3 buckets storing sensitive data and the associated AWS services interacting with them. Which of the following steps should you take to achieve this?
- A
Enable AWS CloudTrail and configure it to log data events for the S3 buckets.
- B
Enable Amazon S3 server access logging to capture detailed bucket access logs.
- C
Use AWS Config to track resource configurations and enable compliance checks.
- D
Enable VPC Flow Logs to capture traffic flow details for the VPC hosting the S3 buckets.
- E
Create a custom Lambda function to log and monitor S3 bucket access events.
Show answer and explanation
Correct answers: A, B
Explanation
To log access to AWS services and S3 buckets, AWS CloudTrail should be used to capture data events for S3, as it logs service-level access and API calls. Additionally, Amazon S3 server access logging provides granular details about who accessed the bucket, creating a comprehensive logging solution. Other options, such as AWS Config and VPC Flow Logs, serve different purposes and do not directly address S3 access logging.
- A. Correct.
Enabling AWS CloudTrail and configuring it to log data events for S3 provides detailed auditing of API calls and access to the buckets. This is essential for tracking service interactions.
- B. Correct.
Enabling Amazon S3 server access logging provides detailed bucket access logs, such as who accessed the bucket and when. This complements CloudTrail for bucket-level insights.
- C. Incorrect.
AWS Config is useful for monitoring configuration changes and compliance but does not provide direct access or service interaction logging.
- D. Incorrect.
VPC Flow Logs capture network traffic but do not provide detailed insights into S3 bucket access or service interactions.
- E. Incorrect.
While a custom Lambda function could log access events, it is not the most efficient or recommended approach when CloudTrail and server access logging already provide this functionality.