AWS Certified SysOps Administrator – AssociateMonitoring, Logging, and RemediationMedium
A security team needs to receive real-time notifications whenever an Amazon S3 bucket's access control list (ACL) is modified, as this could indicate a security vulnerability. The solution must be automated and integrate with existing notification channels. Which AWS services should be used?
- AAWS Config with a custom rule to detect S3 ACL changes, triggering an SNS topic.
- BAWS CloudTrail to log S3 API calls, filtered by Amazon EventBridge, and sent to an SNS topic.
- CAmazon S3 event notifications for object-level changes, sent to an SQS queue.
- DAWS Trusted Advisor to monitor S3 bucket permissions and send daily reports.
Show answer & explanationAnswer & explanation
Correct answer: B. AWS CloudTrail to log S3 API calls, filtered by Amazon EventBridge, and sent to an SNS topic.
CloudTrail logs all API calls, including 'PutBucketAcl' which modifies S3 bucket ACLs. EventBridge can filter these CloudTrail events in near real-time and trigger an SNS topic to send notifications to subscribed channels (email, SMS, Lambda, etc.), meeting the real-time, automated notification requirement.
Why the other options are wrong
- A. AWS Config can monitor S3 bucket ACL compliance, but it typically works on a polling basis or triggers on configuration changes, not necessarily real-time API call events. Creating a custom rule might be complex.
- C. S3 event notifications are primarily for object-level operations (put, delete, restore), not for bucket-level configuration changes like ACL modifications.
- D. Trusted Advisor provides recommendations and checks for security best practices, but it does not offer real-time, automated notifications for specific API calls or configuration changes as they happen.
Real-time S3 ACL Change Alert
Monitor and receive immediate notifications for modifications to Amazon S3 bucket Access Control Lists (ACLs) using a combination of AWS services for security compliance.
- CloudTrail logs S3 API calls like PutBucketAcl.
- EventBridge filters specific CloudTrail events.
- SNS sends real-time notifications.
Memory trick: CloudTrail sees the ACL change, EventBridge alerts, SNS shouts it out!