Examkin

Question

Difficulty: MediumThreat Protection and Web Application Firewall (WAF)

A SysOps administrator needs to configure AWS WAF logging for an Application Load Balancer to store all web request logs in an Amazon S3 bucket for compliance auditing. The administrator creates a bucket named web-application-waf-logs and attempts to enable WAF logging to this bucket, but receives an error stating that the destination is invalid. Which of the following is the reason for this error?

  1. A
    The customer managed KMS key policy used to encrypt the S3 bucket does not permit IAM policy-based access for the WAF service principal.
  2. B
    The S3 bucket policy is missing permissions allowing the CloudTrail service principal to write objects to the bucket.
  3. The S3 bucket name must begin with the prefix aws-waf-logs- for AWS WAF to be able to publish logs to it.Answer
  4. D
    The log retention period configured on the target S3 bucket does not match the active log retention settings of the Web ACL.

Answer

The S3 bucket name must begin with the prefix aws-waf-logs- for AWS WAF to be able to publish logs to it.
AWS WAF requires that any Amazon S3 bucket used as a logging destination must have a name starting with the prefix 'aws-waf-logs-'. Without this prefix, the AWS WAF service will not recognize the bucket as a valid destination, and attempts to enable logging will fail with an invalid destination error.

Step-by-Step Solution

1
Analyze the configuration failure when enabling AWS WAF logging to the S3 bucket.
The target bucket name is web-application-waf-logs.
Identify the destination resource properties that may violate service requirements.
2
Evaluate the naming constraints imposed by AWS WAF on its logging destinations.
AWS WAF mandates that the S3 bucket name must start with the prefix 'aws-waf-logs-'.
Check if the bucket prefix meets the AWS WAF requirements.
3
Determine the corrective action to successfully enable logging.
Rename or create a new S3 bucket with the prefix 'aws-waf-logs-', such as 'aws-waf-logs-web-application'.
Ensures compliance with the required naming convention so that AWS WAF can identify and write to the destination.

Key Concept

AWS WAF Logging Destinations and Naming Conventions
Rate this question

Topics

Threat Protection and Web Application Firewall (WAF)

More questions from this topic