How should a solutions architect meet these requirements?

By:
In: SAA-C02
Tagged:
With: 1 Comment
A company has enabled AWS CloudTrail logs to deliver log files to an Amazon S3 bucket for each of its developer accounts.The company has created a centralAWS account for streamlining management and audit reviews.An internal auditor needs to access the CloudTrail logs, yet access needs to be restricted for all developer account users.The solution must be secure and optimized.

How should a solutions architect meet these requirements?

Configure an AWS Lambda function in each developer account to copy the log files to the central account. Create an IAM role in the central account for the auditor. Attach an IAM policy providing read-only permissions to the bucket.

Configure CloudTrail from each developer account to deliver the log files to an S3 bucket in the central account. Create an IAM user in the central account for the auditor. Attach an IAM policy providing full permissions to the bucket.

Configure CloudTrail from each developer account to deliver the log files to an S3 bucket in the central account. Create an IAM role in the central account for the auditor. Attach an IAM policy providing read-only permissions to the bucket.

Configure an AWS Lambda function in the central account to copy the log files from the S3 bucket in each developer account. Create an IAM user in the central account for the auditor. Attach an IAM policy providing full permissions to the bucket.

Explanations:

While this option uses a Lambda function to copy logs, it creates unnecessary complexity and doesn’t centralize log delivery directly from the developer accounts to the central account, which is more efficient.

Although it delivers logs to the central account, giving full permissions to the auditor is not secure. The requirement specifies read-only access to ensure security.

This option correctly configures CloudTrail to deliver logs to the central account and uses a role with read-only permissions, aligning with security requirements while optimizing log access.

This option involves a Lambda function in the central account to copy logs, which is not needed if logs are delivered directly from the developer accounts. Also, it grants full permissions, which is not secure.

2025-10-14

1 Comment

  1. Paul
    Author

    I believe the answer is:
    Configure CloudTrail from each developer account to deliver the log files to an S3 bucket in the central account. Create an IAM role in the central account for the auditor. Attach an IAM policy providing read-only permissions to the bucket.

Leave a Reply

Your email address will not be published. Required fields are marked *

13 − 1 =