DEA-C01 Question 524
Select 2Your organization wants to track and analyze all access requests made to AWS services for governance and compliance purposes. Which methods can you use to log access to AWS services?
- A
Enable AWS CloudTrail to log API activity across AWS services
- B
Use Amazon CloudWatch Logs to directly capture API calls to AWS services
- C
Enable VPC Flow Logs to track all HTTP requests to AWS services
- D
Configure AWS Config to record resource configuration changes and API access history
- E
Enable Amazon S3 server access logging to track requests to S3 buckets
Show answer and explanation
Correct answers: A, E
Explanation
AWS CloudTrail is designed to log API activity across AWS services, providing detailed information about who accessed what and when. For S3 buckets, enabling server access logging provides visibility into requests made to S3. While other services like AWS Config, CloudWatch Logs, and VPC Flow Logs provide valuable insights, they do not directly log access to AWS services or API activity.
- A. Correct.
CloudTrail is the primary service for logging API activity and access to AWS services, making it a correct option.
- B. Incorrect.
CloudWatch Logs is used for log storage and monitoring but does not directly capture API calls. It relies on other services like CloudTrail for this information.
- C. Incorrect.
VPC Flow Logs capture network traffic within a VPC, not API calls or access to AWS services.
- D. Incorrect.
AWS Config focuses on recording resource configuration changes and compliance, but it does not log API calls or access to AWS services.
- E. Correct.
S3 server access logging provides detailed records about access requests to S3 buckets, making it a correct option for logging access to this specific service.