SCS-C02 Question 144
Single answerA company has enabled AWS CloudTrail for auditing purposes. However, the security team notices that some API activity logs are missing from the S3 bucket where CloudTrail delivers logs. Upon investigation, they find that CloudTrail is configured to send logs to the correct S3 bucket, and the bucket has the proper permissions. Which of the following could be the reason for the missing logs and how can it be resolved?
- A
CloudTrail logging is disabled for one or more AWS regions. Enable CloudTrail logging in all regions.
- B
The S3 bucket is encrypted using a custom KMS key, and CloudTrail does not have permissions to use the key.
- C
The CloudTrail log file validation feature is disabled, causing logs to be overwritten or lost.
- D
The S3 bucket is configured with an incorrect lifecycle policy that deletes logs prematurely.
Show answer and explanation
Correct answer: B
Explanation
When CloudTrail logs are missing from an S3 bucket despite correct bucket permissions, a common cause is a lack of sufficient permissions for CloudTrail to use the bucket's encryption key. If a custom KMS key is used, the key policy must explicitly allow CloudTrail to encrypt and decrypt logs. Verifying and updating the KMS key policy will resolve the issue.
- A. Incorrect.
Incorrect. CloudTrail logs API activity for all regions by default when set to 'All Regions.' If logging were disabled for a region, it would not explain why some logs are missing from a correctly configured S3 bucket.
- B. Correct.
Correct. If the S3 bucket is encrypted with a custom KMS key, and CloudTrail does not have the necessary permissions to use the key, it cannot write logs to the bucket. This would result in missing logs.
- C. Incorrect.
Incorrect. Log file validation ensures the integrity of CloudTrail logs but does not directly impact whether logs are delivered to the S3 bucket.
- D. Incorrect.
Incorrect. While an incorrect lifecycle policy could delete logs prematurely, this would not explain why logs are missing upon delivery.