Your company makes use of S3 buckets for storing data. There is a company policy that all services should have logging enabled. How can you ensure that logging is always enabled for created S3…

Question

Options

• AUse AWS Inspector to inspect all S3 buckets and enable logging for those where it is not enabled
• BUse AWS Config Rules to check whether logging is enabled for buckets
• CUse AWS Cloudwatch metrics to check whether logging is enabled for buckets
• DUse AWS Cloudwatch logs to check whether logging is enabled for buckets

• A
  12% (4)
• B
  79% (26)
• C
  6% (2)
• D
  3% (1)

Explanation

This is given in the AWS Documentation as an example rule in AWS Config Example rules with triggers Example rule with configuration change trigger 1. You add the AWS Config managed rule, S3_BUCKET_LOGGING_ENABLED, to your account to check whether your Amazon S3 buckets have logging enabled. 2. The trigger type for the rule is configuration changes. AWS Config runs the evaluations for the rule when an Amazon S3 bucket is created, changed, or deleted. 3. When a bucket is updated, the configuration change triggers the rule and AWS Config evaluates whether the bucket is compliant against the rule. Option A is invalid because AWS Inspector cannot be used to scan all buckets Option C and D are invalid because Cloudwatch cannot be used to check for logging enablement https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config-rules.html

No community discussion yet for this question.