Examkin

Soru

Zorluk: ZorAWS CloudTrail Configuration and Management

An organization's security policy requires a SysOps Administrator to perform log file integrity validation on AWS CloudTrail logs from the previous quarter. The CloudTrail logs and digest files are delivered to an Amazon S3 bucket. An S3 Lifecycle rule is configured to transition all objects under the `AWSLogs/` prefix to the S3 Glacier Flexible Retrieval storage class after 30 days. When the administrator attempts to validate the logs using the command `aws cloudtrail verify-log-file`, the command fails with an error indicating that the operation is not valid for the object's storage class. Which action will resolve this issue and allow the administrator to successfully validate the logs?

  1. A
    Modify the S3 bucket policy to grant `s3:GetObject` permissions to the `cloudtrail.amazonaws.com` service principal for Glacier objects, and re-run the verification command.
  2. B
    Re-run the verification command with the `--digest-only` parameter to perform the integrity check using only the metadata stored under the CloudTrail-Digest prefixes.
  3. Initiate a restore request for both the log files and the digest files in the S3 bucket, wait for the restore process to complete, and then run the verification command.Cevap
  4. D
    Configure an IAM policy for the administrator's role that includes `iam:PassRole` permissions for the CloudTrail service principal, and re-run the verification command with the `--restore-glacier` parameter.

Cevap

Initiate a restore request for both the log files and the digest files in the S3 bucket, wait for the restore process to complete, and then run the verification command.
The correct action is to initiate a restore request for both the log files and the digest files, wait for the restore process to complete, and then run the validation command. The AWS CLI `verify-log-file` command downloads the log and digest files to compute and compare SHA-256 hashes. Because Glacier objects are archived, they cannot be read directly. Temporary restoration to S3 Standard is necessary for the command to succeed.

Adım Adım Çözüm

1
Identify the storage class of the CloudTrail logs and digest files for the target time period.
The files are determined to be in the S3 Glacier Flexible Retrieval storage class.
Objects in Glacier cannot be accessed directly via GetObject operations required by CLI verification commands.
2
Initiate a temporary restore operation (e.g., using S3 Batch Operations or a script) for both the `.json.gz` log files and the `.json.gz.digest` files.
S3 begins restoring the objects to a temporarily accessible state in S3 Standard.
Both log and digest files must be readable to perform the cryptographic hash validation.
3
Wait for the restoration process to complete, then execute the command: `aws cloudtrail verify-log-file --s3-bucket <bucket-name> --trail-arn <trail-arn> --start-time <start-time> --end-time <end-time>`
The command successfully retrieves the files, calculates the hashes, and verifies log integrity.
Once restored, the CLI can download the files and perform the validation.

Anahtar Kavram

CloudTrail Log File Integrity Validation requires readable access to both digest and log files, meaning archived S3 Glacier objects must be restored before verification.
Bu soruyu puanla

Konular

AWS CloudTrail Configuration and Management

Bu konudan daha fazla soru