AWS Certified Security – SpecialtyDomain 1: Incident ResponseEasy
A global e-commerce company uses AWS CloudTrail to log API activity across multiple accounts. A security engineer is investigating a series of unauthorized 'DeleteObject' API calls to an Amazon S3 bucket containing sensitive customer data. The engineer needs to quickly determine the source IP address, IAM principal, and user agent responsible for these specific actions. Which CloudTrail feature should the engineer use to efficiently filter and retrieve this information?
- AAmazon Athena to query CloudTrail logs stored in S3.
- BS3 Access Logs configured on the target bucket.
- CCloudTrail Lake for advanced query capabilities.
- DCloudTrail Event History in the AWS Management Console.
Show answer & explanationAnswer & explanation
Correct answer: D. CloudTrail Event History in the AWS Management Console.
CloudTrail Event History in the AWS Management Console provides a quick and easy way to filter and view recent API activity, including details like source IP, IAM principal, and user agent, without needing to set up complex queries or external services for immediate investigation.
Why the other options are wrong
- A. Using Athena to query CloudTrail logs in S3 is effective for historical or complex analysis but requires setting up tables and running SQL queries, which is less immediate than Event History for a quick check.
- B. S3 Access Logs record object-level requests made directly to S3, but CloudTrail records API calls, which is what 'DeleteObject' is. Also, it's not a CloudTrail feature.
- C. CloudTrail Lake is powerful for long-term analysis and complex queries, but for a quick, immediate investigation of recent events, Event History is faster and simpler.
CloudTrail Event History
A feature in the AWS Management Console that displays a record of the past 90 days of management events and data events (if configured) in your AWS account.
- Provides a quick overview of recent API activity.
- Allows filtering by event name, user, resource type, etc.
- Useful for immediate incident investigation.
Memory trick: For quick checks, Event History is your instant replay.