A SysOps Administrator is configuring a new AWS CloudTrail trail to deliver log files to an Amazon S3 bucket. The trail is currently failing to deliver logs. Which two configurations must be present in the S3 bucket policy to allow AWS CloudTrail to successfully deliver the log files? (Select two.)
- A statement that grants s3:PutObject permission to the CloudTrail service principal (cloudtrail.amazonaws.com).Answer
- A statement that grants s3:GetBucketAcl permission to the CloudTrail service principal (cloudtrail.amazonaws.com).Answer
- CA statement that grants s3:GetObject permission to the CloudTrail service principal (cloudtrail.amazonaws.com).
- DA statement that grants iam:PassRole permission to the CloudTrail service principal (cloudtrail.amazonaws.com).
Answer
To allow AWS CloudTrail to deliver logs, the S3 bucket policy must grant s3:PutObject and s3:GetBucketAcl permissions to the CloudTrail service principal (cloudtrail.amazonaws.com).
For CloudTrail to successfully deliver logs to an S3 bucket, the S3 bucket policy must allow the CloudTrail service principal (cloudtrail.amazonaws.com) to perform both s3:GetBucketAcl (to verify the bucket's existence and ownership) and s3:PutObject (to write the log files into the bucket).
Step-by-Step Solution
Key Concept
AWS CloudTrail requires permissions to write logs (s3:PutObject) and check bucket ownership (s3:GetBucketAcl) via an S3 bucket policy.