GetObject and DeleteObject operations on sensitive data must be auditable.
Management events alone do not provide the required object-level detail.
Which approach is most appropriate?
Enable CloudTrail data events for the required bucket or prefixes and protect the resulting audit trail.
Detailed explanation
Management events may not include each GetObject or DeleteObject operation.
Management events may not include each GetObject or DeleteObject operation.
Lifecycle manages object retention and transitions, not access audit records.
Lifecycle manages object retention and transitions, not access audit records.
Dashboard history cannot cover API or non-dashboard S3 access.
Dashboard history cannot cover API or non-dashboard S3 access.
Data events capture object-level data-plane operations and their principals and times.
Data events capture object-level data-plane operations and their principals and times.
Check official documentation
Compare the following points with the official documentation.
AWS CloudTrail data events、S3 object-level logging、management eventsの公式説明を確認する。
What to confirm
管理イベントとデータイベントの監査対象の違いを説明できる。
Key points
- CloudTrail data events
- S3 object-level
- Audit
- Scope
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Cost control
Record sensitive prefixes and required operations rather than every object in every account.
Tamper resistance
Store logs in a separate protected account or bucket with integrity and retention controls.