Investigators need request details and sources for a sensitive bucket.
Choose the appropriate audit granularity in addition to object-level API events.
Which audit-log approach is most appropriate?
Compare S3 server access logging with CloudTrail S3 data events and select the coverage needed.
Detailed explanation
The two sources provide different request and principal details and can be selected by requirement.
The two sources provide different request and principal details and can be selected by requirement.
Object transitions are not general request records.
Object transitions are not general request records.
A name change produces no request audit trail.
A name change produces no request audit trail.
Direct S3 callers are not captured by a visualization history.
Direct S3 callers are not captured by a visualization history.
Check official documentation
Compare the following points with the official documentation.
Amazon S3 server access logging、CloudTrail S3 data events、object-level loggingの公式説明を確認する。
What to confirm
S3アクセスログとCloudTrailデータイベントの粒度・用途の違いを説明できる。
Key points
- S3 access logs
- Data events
- Request
- Audit
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Use-case choice
Request troubleshooting and principal/API accountability may require different sources.
Log loop
Place the logging destination in a separate bucket and control its own permissions.