A SysOps administrator needs to configure AWS WAF logging for an Application Load Balancer to store all web request logs in an Amazon S3 bucket for compliance auditing. The administrator creates a bucket named web-application-waf-logs and attempts to enable WAF logging to this bucket, but receives an error stating that the destination is invalid. Which of the following is the reason for this error?
- AThe customer managed KMS key policy used to encrypt the S3 bucket does not permit IAM policy-based access for the WAF service principal.
- BThe S3 bucket policy is missing permissions allowing the CloudTrail service principal to write objects to the bucket.
- The S3 bucket name must begin with the prefix aws-waf-logs- for AWS WAF to be able to publish logs to it.Cevap
- DThe log retention period configured on the target S3 bucket does not match the active log retention settings of the Web ACL.
Cevap
The S3 bucket name must begin with the prefix aws-waf-logs- for AWS WAF to be able to publish logs to it.
AWS WAF requires that any Amazon S3 bucket used as a logging destination must have a name starting with the prefix 'aws-waf-logs-'. Without this prefix, the AWS WAF service will not recognize the bucket as a valid destination, and attempts to enable logging will fail with an invalid destination error.
Adım Adım Çözüm
Anahtar Kavram
AWS WAF Logging Destinations and Naming Conventions