SCS-C02 Question 157
Select 3An organization wants to enable AWS CloudTrail to log all API activity in their environment. The security team needs to configure access permissions for the CloudTrail log files stored in an S3 bucket. Which of the following permissions are necessary to ensure that CloudTrail can successfully deliver logs to the S3 bucket?
- A
Grant the CloudTrail service principal ('cloudtrail.amazonaws.com') the 's3:PutObject' permission on the specific bucket
- B
Grant the CloudTrail service principal ('cloudtrail.amazonaws.com') the 's3:GetObject' permission on the specific bucket
- C
Grant the AWS user enabling CloudTrail the 's3:PutBucketPolicy' permission to configure bucket policies
- D
Ensure the S3 bucket policy explicitly allows access from the CloudTrail service principal ('cloudtrail.amazonaws.com')
- E
Grant the CloudTrail service principal ('cloudtrail.amazonaws.com') the 's3:DeleteObject' permission on the specific bucket
Show answer and explanation
Correct answers: A, C, D
Explanation
To enable CloudTrail to log API activity and store logs in an S3 bucket, several permissions must be configured. First, the CloudTrail service principal ('cloudtrail.amazonaws.com') must have the 's3:PutObject' permission to write logs to the bucket. Additionally, the user enabling CloudTrail must have the 's3:PutBucketPolicy' permission to configure the necessary bucket policy. Finally, the S3 bucket policy must explicitly allow access from the CloudTrail service principal to ensure CloudTrail can deliver the logs. Permissions like 's3:GetObject' and 's3:DeleteObject' are not relevant in this scenario.
- A. Correct.
Correct. The 's3:PutObject' permission is required for CloudTrail to write logs to the S3 bucket.
- B. Incorrect.
Incorrect. The 's3:GetObject' permission is not required by CloudTrail to deliver logs. This permission is used for reading objects, not writing them.
- C. Correct.
Correct. The AWS user enabling CloudTrail needs the 's3:PutBucketPolicy' permission to add the necessary bucket policy granting CloudTrail access.
- D. Correct.
Correct. The S3 bucket policy must explicitly allow access from the CloudTrail service principal ('cloudtrail.amazonaws.com') for the logs to be delivered.
- E. Incorrect.
Incorrect. The 's3:DeleteObject' permission is not required for CloudTrail to deliver logs, as it only needs permissions to write logs, not delete them.