Examkin

Question

Difficulty: EasyAWS CloudTrail Configuration and Management

A SysOps Administrator created a new trail in AWS CloudTrail to log API activity across an AWS account and configured it to deliver log files to a newly created Amazon S3 bucket. A few hours later, the administrator notices that no log files have been delivered to the S3 bucket. Which of the following configuration issues is the most likely cause of this failure?

  1. The S3 bucket policy does not grant the CloudTrail service principal permission to perform the s3:PutObject action on the bucket.Answer
  2. B
    The IAM identity used to create the trail is missing the iam:PassRole permission to pass the CloudTrail service role.
  3. C
    The AWS account is missing an Amazon EventBridge rule to route CloudTrail events from the default event bus to the destination S3 bucket.
  4. D
    The CloudTrail trail is configured with standard monitoring instead of detailed monitoring, which prevents automatic log file delivery.

Answer

The destination S3 bucket policy does not grant the CloudTrail service principal permission to perform the s3:PutObject action on the bucket.
AWS CloudTrail writes log files directly to the destination Amazon S3 bucket by assuming the CloudTrail service principal identity. To allow this, the S3 bucket policy must contain a statement that grants the 'cloudtrail.amazonaws.com' service principal permission to perform 's3:PutObject' and 's3:GetBucketAcl' actions. If these permissions are missing, CloudTrail cannot deliver the logs, resulting in empty buckets.

Step-by-Step Solution

1
Identify how AWS CloudTrail authentication and authorization to external resources works.
CloudTrail is an AWS service that delivers log files directly to an Amazon S3 bucket. It does not use an IAM role by default for S3 delivery; it uses a resource-based policy (S3 bucket policy).
This helps determine if the issue lies in an IAM role policy or the S3 bucket policy.
2
Analyze the permission requirements for the S3 bucket policy.
The bucket policy must explicitly allow the 'cloudtrail.amazonaws.com' principal to call the 's3:PutObject' action on the bucket's prefix path.
Without this policy, CloudTrail will receive an Access Denied error when attempting to write log files, and delivery will fail.
3
Evaluate the options to find the matching configuration issue.
The option specifying that the S3 bucket policy does not grant the CloudTrail service principal permission to perform the s3:PutObject action matches the correct root cause.
This is the most common reason for failed CloudTrail log delivery when a new bucket is targeted.

Key Concept

AWS CloudTrail log delivery requires the destination S3 bucket policy to grant s3:PutObject permissions to the cloudtrail.amazonaws.com service principal.
Estimated Time:45s
Rate this question

Topics

AWS CloudTrail Configuration and Management

More questions from this topic