An organization sends CloudTrail events to S3 for audit purposes.
It must decide who configures collection, storage, access, and encryption.
Which activity is performed by the customer?
CloudTrail is an AWS service, but the customer configures trails, destinations, permissions, encryption, and retention requirements for its audit records.
Detailed explanation
The customer determines how its logs are classified, protected, and retained.
The customer determines how its logs are classified, protected, and retained.
Audit objectives and retention requirements come from the customer or its organization.
Audit objectives and retention requirements come from the customer or its organization.
The customer selects the event collection and destination, then configures access, encryption, and retention to meet its requirements.
The customer selects the event collection and destination, then configures access, encryption, and retention to meet its requirements.
AWS operates the CloudTrail service infrastructure.
AWS operates the CloudTrail service infrastructure.
Check official documentation
Compare the following points with the official documentation.
AWS CloudTrail User GuideのData protectionとSSE-KMSの説明を確認する。
What to confirm
CloudTrailの保存・アクセス・暗号化設定は利用者が管理する。
Key points
- CloudTrail trail
- Audit log
- S3 and KMS configuration
Notes
- Environment: AWS公式ドキュメントのCloudTrail設定確認
- Confirm the service-specific responsibility boundary in the current AWS documentation.
Foundation review
Audit configuration
Enabling a service does not by itself define collection scope, destination, or retention.
Log protection
S3 permissions and KMS policy settings protect the audit record.