SCS-C02 Question 73
Single answerYour company uses Amazon S3 to store sensitive customer data. As part of a compliance requirement, you need to collect detailed information about access requests to these objects, including the source IP addresses, user identities, and actions performed. Which mechanism is the most appropriate for capturing this data?
- A
Enable Amazon S3 server access logging on the bucket.
- B
Enable AWS CloudTrail logging for the S3 data events.
- C
Use VPC Flow Logs to capture network traffic to the S3 bucket.
- D
Enable Amazon S3 event notifications for all object-level operations.
Show answer and explanation
Correct answer: B
Explanation
To meet the compliance requirement, AWS CloudTrail data event logging for S3 is the most suitable mechanism. It provides detailed information about S3 object-level activities, including source IP addresses, user identities, and actions performed. Other options, such as server access logging or VPC Flow Logs, do not provide the required level of detail or are intended for different purposes.
- A. Incorrect.
Amazon S3 server access logging provides basic logs about requests to the bucket, such as request type and requester. However, it does not capture detailed information like source IP addresses and user identities.
- B. Correct.
AWS CloudTrail logging for S3 data events is specifically designed to capture detailed information about object-level API activity, including source IPs, user identities, and actions performed. This makes it the most appropriate choice.
- C. Incorrect.
VPC Flow Logs capture network traffic at the VPC level, which does not provide granular details about S3 object-level actions or user identities.
- D. Incorrect.
Amazon S3 event notifications are used to trigger actions or workflows (like Lambda functions) based on specific S3 events. They are not designed for capturing detailed access information.