Only the security team may read audit logs.
Workload operators must not be able to modify or delete the trail.
Which audit-log approach is most appropriate?
Separate the log account, write path, read-only role, and deletion controls and review access regularly.
Detailed explanation
Auditing an action does not replace access-policy design.
Auditing an action does not replace access-policy design.
Anyone with the key and bucket permission could still read data.
Anyone with the key and bucket permission could still read data.
Generation, retention, investigation, and removal are independently controlled.
Generation, retention, investigation, and removal are independently controlled.
Any administrator could read, change, or delete evidence.
Any administrator could read, change, or delete evidence.
Check official documentation
Compare the following points with the official documentation.
AWS centralized logging、S3 bucket policy、Object Lock、IAM least privilegeの公式説明を確認する。
What to confirm
暗号化だけでなく、ログへの閲覧・削除権限を分離する理由を説明できる。
Key points
- Log account
- Separation of duties
- Read-only
- Object Lock
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Custodian separation
Workload administrators should not be able to remove the evidence they generate.
Review
Periodically review reader roles, emergency access, and departed users.