SCS-C02 Question 141
Single answerAn organization is using AWS CloudTrail to log API activity in their environment. Recently, they noticed that CloudTrail logs are not being delivered to the S3 bucket they specified. Upon investigation, they found that the S3 bucket exists and is accessible. What could be the cause of this issue?
- A
The IAM role used by CloudTrail does not have sufficient permissions to write to the S3 bucket.
- B
The S3 bucket is encrypted with an AWS KMS key that does not allow CloudTrail to use it.
- C
CloudTrail has reached its service limit for the number of trails per region.
- D
The S3 bucket policy does not allow the 's3:PutObject' permission for CloudTrail logs.
Show answer and explanation
Correct answer: D
Explanation
The most likely issue in this scenario is a missing 's3:PutObject' permission in the S3 bucket policy. CloudTrail needs this permission to write logs to the specified S3 bucket. While other options might cause issues in different scenarios, they do not align with the symptoms described in the question.
- A. Incorrect.
Incorrect: If the IAM role did not have sufficient permissions, CloudTrail would not be able to access the S3 bucket at all, but the question states that the bucket is accessible.
- B. Incorrect.
Incorrect: While encryption settings might affect access to the S3 bucket, the question does not mention any encryption-related issues, making this an unlikely cause.
- C. Incorrect.
Incorrect: CloudTrail service limits are unrelated to log delivery issues. Service limits would prevent creating new trails, not delivering logs to an existing S3 bucket.
- D. Correct.
Correct: CloudTrail requires the 's3:PutObject' permission in the S3 bucket policy to successfully deliver logs. If this permission is missing, logs will not be written to the bucket.