A company stores its processed data in an S3 bucket. The company has a strict data access policy. The company uses IAM roles to grant teams within the company different levels of access to the S3…

Question

Options

• AUse AWS Config rules to detect violations of the data access policy. Set up compliance alarms.
• BUse Amazon CloudWatch metrics to gather object-level metrics. Set up CloudWatch alarms.
• CUse AWS CloudTrail to track object-level events for the S3 bucket. Forward events to Amazon
• DUse Amazon S3 server access logs to monitor access to the bucket. Forward the access logs to

• B
  10% (2)
• C
  86% (18)
• D
  5% (1)

Explanation

AWS CloudTrail is the correct choice because it records every API call made to AWS services, including S3 object-level operations (GetObject, PutObject, DeleteObject, etc.). Critically, each CloudTrail log event includes the identity of the caller (userIdentity field), which contains the username or IAM role. You can forward CloudTrail events to Amazon EventBridge or Amazon SNS to trigger notifications. AWS Config (A) detects resource configuration drift, not individual user access events. CloudWatch object-level metrics (B) aggregate statistics but do not identify individual users per request. S3 server access logs (D) can capture access but lack real-time notification capability and require more setup to extract usernames reliably.

No community discussion yet for this question.