To verify that CloudTrail logs have not been tampered with after delivery, an organization enables log file integrity validation. A SysOps administrator attempting to run the `aws cloudtrail validate-logs` command from the AWS CLI receives access denied errors when the command attempts to fetch the digest files from the Amazon S3 log bucket. The administrator has the necessary CloudTrail permissions, but the S3 bucket policy is highly restrictive. Which two modifications will resolve this access issue and allow log validation? (Select two.)
- Grant the `s3:GetObject` permission on the log and digest objects to the administrator's IAM identity in the S3 bucket policy.Cevap
- Grant the `s3:ListBucket` permission on the bucket to the administrator's IAM identity in the S3 bucket policy.Cevap
- CGrant the `iam:PassRole` permission for the CloudTrail service role to the administrator's IAM identity.
- DGrant the `s3:ListBucket` permission on the bucket to the CloudTrail service principal (`cloudtrail.amazonaws.com`) in the S3 bucket policy.
- EConfigure an Amazon EventBridge rule that triggers an AWS Systems Manager Automation document to bypass the S3 bucket policy restrictions.
Cevap
Granting `s3:GetObject` and `s3:ListBucket` permissions on the S3 bucket to the administrator's IAM identity.
To validate CloudTrail logs using the AWS CLI `validate-logs` command, the executing IAM identity must have read access to both the log files and the digest files in the Amazon S3 bucket. This requires the S3 bucket policy to permit the `s3:GetObject` action on the objects stored in the bucket and the `s3:ListBucket` action on the bucket itself so that the CLI can locate and retrieve the digest and log files.
Adım Adım Çözüm
Anahtar Kavram
CloudTrail log file integrity validation relies on digest files stored in the S3 bucket, requiring the validating identity to have list and read permissions on those S3 resources.