DEA-C01 Question 529
Select 3Your organization uses multiple AWS accounts for various teams, and you’ve been tasked with setting up a centralized logging solution to collect all CloudTrail logs in a single AWS account for compliance and auditing purposes. Which of the following steps should you take to accomplish this?
- A
Enable CloudTrail in each AWS account and configure it to send logs to an Amazon S3 bucket in the central logging account.
- B
Use AWS Organizations to enable CloudTrail logs for all member accounts and send them to a central Amazon S3 bucket.
- C
Ensure the central Amazon S3 bucket has proper bucket policies allowing cross-account access for CloudTrail logs.
- D
Enable Amazon S3 access logging on the central Amazon S3 bucket to track write operations by the CloudTrail service.
- E
Create a VPC endpoint for S3 in each account to ensure secure delivery of CloudTrail logs to the central bucket.
Show answer and explanation
Correct answers: A, C, D
Explanation
To centralize CloudTrail logs, you need to enable CloudTrail in each account and configure it to send logs to a central Amazon S3 bucket. It is critical to configure proper bucket policies to allow cross-account access for the logs. Additionally, enabling S3 access logging on the central bucket ensures that you can track log delivery activity. AWS Organizations aids in managing accounts but does not automatically centralize logs, and VPC endpoints for S3 are optional, not required.
- A. Correct.
Correct: CloudTrail must be enabled in each AWS account, and the logs can then be sent to an S3 bucket in the central logging account.
- B. Incorrect.
Incorrect: AWS Organizations can help in enabling CloudTrail across accounts, but it does not automatically consolidate logs into a central bucket.
- C. Correct.
Correct: The central Amazon S3 bucket must have proper bucket policies to allow cross-account CloudTrail logs to be delivered.
- D. Correct.
Correct: Enabling S3 access logging on the central bucket is a best practice to track write operations and validate log delivery.
- E. Incorrect.
Incorrect: While VPC endpoints for S3 can enhance security, they are not mandatory for a centralized logging solution for CloudTrail.