AWS Certified Security – SpecialtyDomain 2: Logging and MonitoringMedium
A financial institution requires continuous monitoring of administrative activities within their AWS accounts to detect any unauthorized changes to security configurations or resource policies. They need to ensure that all API calls and console actions are recorded, immutable, and retained for seven years for audit purposes. Which AWS service should be configured to meet these requirements, and what feature ensures immutability?
- AAWS Config with S3 Event Notifications
- BAWS CloudTrail with S3 object lock
- CAWS Security Hub with automated response playbooks
- DAmazon CloudWatch Logs with log group retention policies
Show answer & explanationAnswer & explanation
Correct answer: B. AWS CloudTrail with S3 object lock
AWS CloudTrail records all API calls and console actions, providing a comprehensive audit trail. Storing CloudTrail logs in S3 with S3 Object Lock enabled ensures the immutability of these logs for the required retention period, meeting the audit and immutability requirements.
Why the other options are wrong
- A. AWS Config tracks resource configuration changes, but CloudTrail specifically logs API calls and console actions. S3 Event Notifications are for triggering actions, not for ensuring immutability.
- C. AWS Security Hub aggregates findings and orchestrates responses, but it does not directly record API calls or provide underlying immutability for raw log data.
- D. CloudWatch Logs stores logs, and log group retention policies manage their lifespan, but it does not inherently guarantee immutability in the same way S3 Object Lock does for compliance.
AWS CloudTrail with S3 Object Lock
CloudTrail records AWS API calls and console actions, and S3 Object Lock provides WORM (Write Once, Read Many) protection for objects stored in S3, ensuring log immutability.
- CloudTrail provides a history of AWS API calls for auditing.
- S3 Object Lock prevents objects from being deleted or overwritten.
- Combined, they meet strict compliance requirements for log integrity and retention.
Memory trick: CloudTrail logs actions, S3 Lock ensures facts forever last.