SCS-C02 Question 142
Select 4An organization has enabled AWS CloudTrail to log API activity across its AWS accounts. However, the security team notices that certain critical API events are not being logged in the designated Amazon S3 bucket. Upon investigation, they find that the issue occurs intermittently and only for specific accounts in their organization. Which of the following actions can help troubleshoot and resolve the issue?
- A
Verify that the CloudTrail logs are being delivered to the correct S3 bucket by checking the S3 bucket policy.
- B
Ensure that the AWS Organizations service access is enabled for CloudTrail to function across all accounts in the organization.
- C
Check if the CloudTrail trails are configured as multi-region trails to capture API activity from all regions.
- D
Review the IAM roles and policies associated with the CloudTrail logging functionality to ensure they have sufficient permissions.
- E
Verify whether CloudTrail logging is explicitly disabled at the account level in any affected accounts.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
The issue involves missing CloudTrail logs for specific accounts, which can be caused by several factors, including incorrect S3 bucket policies, missing AWS Organizations service access, insufficient IAM permissions, or explicit disabling of CloudTrail logging at the account level. Verifying and addressing each of these areas ensures that the configuration supports consistent logging across all accounts.
- A. Correct.
CloudTrail logs are delivered to an S3 bucket, and if the bucket policy is incorrectly configured, the logs might not be delivered. Verifying the bucket policy can help identify and resolve this issue.
- B. Correct.
If AWS Organizations service access is not enabled, CloudTrail might not function properly across the organization's accounts. This step ensures that the organization-wide trail can log events from all accounts.
- C. Incorrect.
While configuring CloudTrail as a multi-region trail is a best practice, it does not address the issue of missing logs for specific accounts, as this problem is more likely related to permissions or configuration issues.
- D. Correct.
IAM roles and policies play a crucial role in allowing CloudTrail to write logs to the S3 bucket or to enable logging across accounts. Reviewing these permissions can help resolve any related issues.
- E. Correct.
CloudTrail logging can be explicitly disabled at the account level, which would prevent events from being logged for those accounts. Verifying this setting ensures that logging is enabled for all accounts.