Question

Difficulty: EasyAWS CloudTrail Configuration and Management

A SysOps Administrator is configuring a new AWS CloudTrail trail to deliver log files to an Amazon S3 bucket. The trail is currently failing to deliver logs. Which two configurations must be present in the S3 bucket policy to allow AWS CloudTrail to successfully deliver the log files? (Select two.)

  1. A statement that grants s3:PutObject permission to the CloudTrail service principal (cloudtrail.amazonaws.com).Answer
  2. A statement that grants s3:GetBucketAcl permission to the CloudTrail service principal (cloudtrail.amazonaws.com).Answer
  3. C
    A statement that grants s3:GetObject permission to the CloudTrail service principal (cloudtrail.amazonaws.com).
  4. D
    A statement that grants iam:PassRole permission to the CloudTrail service principal (cloudtrail.amazonaws.com).

Answer

To allow AWS CloudTrail to deliver logs, the S3 bucket policy must grant s3:PutObject and s3:GetBucketAcl permissions to the CloudTrail service principal (cloudtrail.amazonaws.com).
For CloudTrail to successfully deliver logs to an S3 bucket, the S3 bucket policy must allow the CloudTrail service principal (cloudtrail.amazonaws.com) to perform both s3:GetBucketAcl (to verify the bucket's existence and ownership) and s3:PutObject (to write the log files into the bucket).

Step-by-Step Solution

1
Identify the service principal for AWS CloudTrail.
The service principal is cloudtrail.amazonaws.com.
Permissions in the bucket policy must target the specific service principal representing CloudTrail.
2
Configure permissions for verifying bucket ownership.
Grant s3:GetBucketAcl to the service principal.
CloudTrail must verify the bucket exists and check its ACLs before writing files.
3
Configure permissions for writing logs.
Grant s3:PutObject to the service principal for the bucket prefix.
CloudTrail needs write permissions to upload the compressed log files to the target prefix in the bucket.

Key Concept

AWS CloudTrail requires permissions to write logs (s3:PutObject) and check bucket ownership (s3:GetBucketAcl) via an S3 bucket policy.
Rate this question