Which solution will meet these requirements?
Enable server access logging for all current S3 buckets. Use the audit logs S3 bucket as a destination for audit logs.
Enable replication between all current S3 buckets and the audit logs S3 bucket. Enable S3 Versioning in the audit logs S3 bucket.
Configure S3 Event Notifications for all current S3 buckets to invoke an AWS Lambda function every time objects are accessed. Store Lambda logs in the audit logs S3 bucket.
Enable AWS CloudTrail, and use the audit logs S3 bucket to store logs. Enable data event logging for S3 event sources, current S3 buckets, and future S3 buckets.
Explanations:
Enabling server access logging will only log requests at the S3 bucket level, not object-level access. It is insufficient for the requirement of object-level logging.
S3 replication is used for copying data between buckets, not for logging access. It does not provide audit logs for object-level access as required.
Configuring S3 Event Notifications to invoke a Lambda function on object access is unnecessary and complex. It would not reliably capture all access events.
AWS CloudTrail can log detailed events, including S3 object-level access. Enabling data event logging for S3 ensures all current and future buckets are logged.
If I had to guess, I’d say the answer is:
Enable AWS CloudTrail, and use the audit logs S3 bucket to store logs. Enable data event logging for S3 event sources, current S3 buckets, and future S3 buckets.
I figure that the answer is:
Enable AWS CloudTrail, and use the audit logs S3 bucket to store logs. Enable data event logging for S3 event sources, current S3 buckets, and future S3 buckets.