Examkin

Question

Difficulty: MediumAWS CloudTrail Configuration and Management

An organization has enabled log file integrity validation on an active AWS CloudTrail trail. While the trail successfully delivers CloudTrail log files to the destination Amazon S3 bucket, the administrator notices that no digest files are being generated or delivered to the bucket, preventing log validation. Which of the following is the most likely cause of this issue?

  1. A
    The IAM policy attached to the CloudTrail service role is missing the iam:PassRole permission, which prevents CloudTrail from passing the execution role to the S3 bucket during digest delivery.
  2. B
    An Amazon EventBridge rule is missing to trigger an AWS Systems Manager Automation document that initiates digest file generation when log files are written to S3.
  3. The S3 bucket policy limits s3:PutObject permissions to the path prefix AWSLogs/123456789012/CloudTrail/*, which prevents CloudTrail from delivering the digest files to the prefix AWSLogs/123456789012/CloudTrail-Digest/*.Answer
  4. D
    The KMS key policy used to encrypt the trail does not allow the kms:GenerateDataKey action for the digest prefix, although it allows it for the log prefix.

Answer

The S3 bucket policy limits s3:PutObject permissions to the path prefix AWSLogs/123456789012/CloudTrail/*, which prevents CloudTrail from delivering the digest files to the prefix AWSLogs/123456789012/CloudTrail-Digest/*.
The correct answer is correct because CloudTrail log file integrity validation stores digest files under the 'CloudTrail-Digest' prefix rather than the standard 'CloudTrail' prefix. If the S3 bucket policy is overly restrictive and only grants permissions for the standard prefix, CloudTrail will fail to write the digests, resulting in missing files and validation failures.

Step-by-Step Solution

1
Identify the storage path for CloudTrail digest files.
CloudTrail stores digest files under the prefix AWSLogs/<AccountID>/CloudTrail-Digest/<Region>/.
Log file integrity validation uses a separate path for storing digest files compared to standard log files.
2
Review the S3 bucket policy permissions granted to the CloudTrail service principal.
The bucket policy must allow the s3:PutObject action on the digest path prefix.
Without this permission, CloudTrail cannot deliver digest files even if log file delivery is working.
3
Determine the corrective action to allow digest delivery.
Update the S3 bucket policy to grant s3:PutObject permission on the CloudTrail-Digest path or use a wildcard matching all paths under AWSLogs/<AccountID>/*.
This resolves the access denied error encountered by CloudTrail during digest delivery.

Key Concept

CloudTrail S3 Bucket Permissions for Log File Integrity Validation
Rate this question

Topics

AWS CloudTrail Configuration and Management

More questions from this topic