SAP-C02 · Question #235
A company uses multiple AWS accounts in a single AWS Region. A solutions architect is designing a solution to consolidate logs generated by Elastic Load Balancers (ELBs) in the AppDev, AppTest, and…
The correct answer is C. Update the S3 bucket policy for the s3-elb-logs bucket to allow the s3:PutObject action for the E. Enable Amazon S3 default encryption using server-side encryption with S3 managed encryption. To consolidate encrypted ELB logs from multiple AWS accounts into a central S3 bucket, the bucket policy must permit the ELB service to write objects, and S3 default encryption must be enabled.
Question
A company uses multiple AWS accounts in a single AWS Region. A solutions architect is designing a solution to consolidate logs generated by Elastic Load Balancers (ELBs) in the AppDev, AppTest, and AppProd accounts. The logs should be stored in an existing Amazon S3 bucket named s3-elb-logs in the central AWS account. The central account is used for log consolidation only and does not have ELBs deployed. ELB logs must be encrypted at rest. Which combination of steps should the solutions architect take to build the solution? (Choose two.)
Options
- AUpdate the S3 bucket policy for the s3-elb-logs bucket to allow the s3:PutBucketLogging action
- BUpdate the S3 bucket policy for the s3-elb-logs bucket to allow the s3:PutObject and
- CUpdate the S3 bucket policy for the s3-elb-logs bucket to allow the s3:PutObject action for the
- DEnable access logging for the ELBs. Set the S3 location to the s3-elb-logs bucket.
- EEnable Amazon S3 default encryption using server-side encryption with S3 managed encryption
How the community answered
(30 responses)- A17% (5)
- B7% (2)
- C73% (22)
- D3% (1)
Why each option
To consolidate encrypted ELB logs from multiple AWS accounts into a central S3 bucket, the bucket policy must permit the ELB service to write objects, and S3 default encryption must be enabled.
`s3:PutBucketLogging` is for configuring server access logging for the S3 bucket itself, not for allowing ELBs to write their logs to the bucket.
While `s3:PutObject` is needed, `s3:GetBucketAcl` is not typically required for ELB log delivery, and the policy must specify the ELB service principal.
The S3 bucket policy for the central log bucket must explicitly grant the Elastic Load Balancing service principal (`elb.amazonaws.com`) permission to perform the `s3:PutObject` action, enabling ELBs from other accounts to deliver log files.
Enabling access logging for ELBs is a necessary configuration step on the ELB side, but it does not address the required S3 bucket policy permissions or the encryption-at-rest requirement.
Enabling default encryption on the target S3 bucket with SSE-S3 ensures that all objects, including the ELB logs, are automatically encrypted at rest as they are written to the bucket, fulfilling the encryption requirement.
Concept tested: Cross-account ELB logging to S3 with encryption
Source: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/enable-access-logging.html
Community Discussion
No community discussion yet for this question.