A company has turned on server access logging for all of its existing Amazon S3 buckets. The company wants to implement a solution to monitor the logging settings for new and existing S3 buckets…

Question

Options

• ATrack the logging information by using AWS CloudTrail. Launch an AWS Lambda function for
• BConfigure automatic remediation in AWS Config by using the s3-bucket-logging-enabled rule.
• CConfigure AWS Trusted Advisor to monitor the logging configuration and to turn on access
• DTrack the logging information by using Amazon CloudWatch metrics. Launch an AWS Lambda

• A
  12% (4)
• B
  79% (26)
• C
  6% (2)
• D
  3% (1)

Explanation

Option B is correct because AWS Config's s3-bucket-logging-enabled managed rule continuously monitors both new and existing S3 buckets for logging compliance, and its built-in automatic remediation feature can trigger an SSM Automation document to re-enable logging on non-compliant buckets - all without writing custom code or managing infrastructure.

Option A is wrong because CloudTrail tracks API calls (who did what), not configuration state; you'd need a Lambda function to act on that data, adding unnecessary operational overhead. Option D fails for the same reason - CloudWatch metrics track operational telemetry, not bucket configuration settings, so you'd again need custom Lambda logic. Option C is wrong because AWS Trusted Advisor can surface configuration insights but does not support automated remediation; it requires manual follow-up.

Memory tip: Think of AWS Config as your compliance cop - it watches resource configurations and can automatically fix violations. When a question asks for monitoring + auto-remediation of an AWS resource setting with minimal operational effort, AWS Config with a managed rule is almost always the answer.

No community discussion yet for this question.