DEA-C01 Question 521
Select 2A data engineering team needs to monitor and log API requests made to Amazon S3 to meet compliance requirements. Which of the following options correctly enables logging of access to AWS services?
- A
Enable AWS CloudTrail and configure it to log S3 data events.
- B
Use Amazon S3 Server Access Logs to capture access requests at the bucket level.
- C
Enable VPC Flow Logs to capture API access requests to Amazon S3.
- D
Turn on AWS Config to track configuration changes and API activity.
- E
Create a custom Lambda function to log API requests and store them in Amazon S3.
Show answer and explanation
Correct answers: A, B
Explanation
To log access to AWS services like Amazon S3, AWS provides built-in solutions like AWS CloudTrail and Amazon S3 Server Access Logs. CloudTrail is used for logging API activity, including data events at the object level, while S3 Server Access Logs track bucket-level access details. These methods are reliable, scalable, and adhere to AWS best practices, making them the correct choices for this scenario.
- A. Correct.
Correct. AWS CloudTrail is used to log API activity and can be configured to log data events for Amazon S3, which captures object-level API requests.
- B. Correct.
Correct. Amazon S3 Server Access Logs capture detailed information about access requests at the bucket level, including who accessed the bucket and when.
- C. Incorrect.
Incorrect. VPC Flow Logs capture information about IP traffic going in and out of network interfaces within a VPC. They do not log API requests to S3.
- D. Incorrect.
Incorrect. AWS Config tracks configuration changes and compliance but does not log API requests. It is not sufficient for this use case.
- E. Incorrect.
Incorrect. While a custom Lambda function could theoretically be used for logging, it is not the recommended or scalable approach for logging API requests to AWS services like S3.