A SysOps administrator must ensure that all of a company's current and future Amazon S3 buckets have logging enabled. If an S3 bucket does not have logging enabled, an automated process must enable…

Question

Options

• AUse AWS Trusted Advisor to perform a check for S3 buckets that do not have logging enabled.
• BConfigure an S3 bucket policy that requires all current and future S3 buckets to have logging
• CUse the s3-bucket-logging-enabled AWS Config managed rule. Add a remediation action that
• DUse the s3-bucket-logging-enabled AWS Config managed rule. Add a remediation action that

• A
  7% (2)
• B
  4% (1)
• C
  14% (4)
• D
  75% (21)

Explanation

Option D is correct because AWS Config's s3-bucket-logging-enabled managed rule continuously evaluates all S3 buckets - including newly created ones - for logging compliance, and pairing it with an AWS Systems Manager (SSM) Automation remediation action automatically enables logging on any non-compliant bucket without human intervention, satisfying both requirements.

Why the distractors fail:

• A (Trusted Advisor): Advisory only - it flags issues but cannot trigger automated remediation.
• B (S3 bucket policy): Bucket policies control access permissions, not configuration like logging; you cannot enforce logging enablement through a bucket policy.
• C: Likely uses an SNS notification as the remediation action, which only alerts someone rather than automatically fixing the bucket - falling short of the "automated process" requirement.

Memory tip: Think of it as a two-part recipe - Config detects (the rule flags non-compliant buckets) + SSM Automation fixes (the remediation action acts). Whenever an exam question asks for both detection and automated correction of AWS resource configuration, reach for AWS Config rule + SSM Automation remediation.

No community discussion yet for this question.