SCS-C02 Question 158
Select 2An organization wants to enable logging for its Amazon S3 buckets to capture access requests and store the logs in a centralized logging bucket. Which of the following permissions must be granted to allow the logging bucket to store logs from other buckets?
- A
The logging bucket must have an S3 Bucket Policy allowing the source buckets to write logs.
- B
The source buckets must have a Bucket Policy granting the logging bucket the 's3:PutObject' permission.
- C
The source buckets must have the 's3:PutBucketLogging' permission for the logging bucket.
- D
The logging bucket must have an IAM Role allowing 's3:GetObject' from the source buckets.
- E
The logging bucket must have a Bucket Policy allowing the S3 Log Delivery Group to write logs.
Show answer and explanation
Correct answers: A, E
Explanation
To enable logging for S3 buckets, the destination logging bucket must explicitly grant permissions to the S3 Log Delivery Group (or the source buckets) to write logs. This is typically done by applying a Bucket Policy to the logging bucket. Incorrect permissions or misconfigured policies can result in logging failures.
- A. Correct.
Correct. The logging bucket needs an S3 Bucket Policy that explicitly allows the source buckets (or the S3 Log Delivery Group) to write logs.
- B. Incorrect.
Incorrect. The source buckets do not need to grant permissions to the logging bucket. Instead, the logging bucket must grant write permissions.
- C. Incorrect.
Incorrect. The 's3:PutBucketLogging' permission is used to enable logging on the source bucket, not for log storage.
- D. Incorrect.
Incorrect. The logging bucket does not require an IAM Role for 's3:GetObject'. Log delivery is handled by S3 internally.
- E. Correct.
Correct. The S3 Log Delivery Group must have 's3:PutObject' permissions on the logging bucket to enable log storage.