A SysOps Administrator creates a new multi-region trail in AWS CloudTrail to log all API activity in the AWS account. The administrator configures a new Amazon S3 bucket as the storage target. After several hours, the administrator notices that no CloudTrail logs have been delivered to the S3 bucket. Which of the following is the most likely cause of this log delivery failure?
- ADetailed monitoring is not enabled on the Amazon S3 bucket, preventing CloudTrail from transmitting metric logs.
- BThe CloudWatch log group associated with CloudTrail has its retention period set to zero days, which automatically deletes logs upon arrival.
- The Amazon S3 bucket policy does not grant the CloudTrail service principal permissions to write objects to the bucket.Cevap
- DThe administrator's IAM policy lacks the iam:PassRole permission, which is required to delegate role permissions to the Amazon S3 bucket.
Cevap
The Amazon S3 bucket policy does not grant the CloudTrail service principal permissions to write objects to the bucket.
The correct answer is correct because AWS CloudTrail requires explicit resource-based permissions (via an S3 bucket policy) to write log objects into the designated S3 bucket. If the bucket policy does not authorize the CloudTrail service principal (cloudtrail.amazonaws.com) for the s3:PutObject action, log delivery will fail.
Adım Adım Çözüm
Anahtar Kavram
Configuring permissions for log delivery targets in security monitoring.