Question

A security engineer must prove to auditors that CloudTrail log files stored in an S3 bucket have not been modified or deleted since delivery. The organization already has a multi-Region trail delivering logs to a dedicated central logging account. During a compliance review, the auditors ask for a mechanism that can cryptographically verify whether any log file was altered or removed after CloudTrail wrote it. Which approach satisfies this requirement?

Accepted Answer

Enable CloudTrail log file integrity validation and use the digest files with the AWS CLI validate-logs command to verify the hashes.

Answer

Enable S3 server-side encryption with SSE-KMS on the log bucket so tampering is prevented by encryption.

Answer

Turn on S3 Versioning and MFA Delete on the log bucket to detect and block modifications.

Answer

Configure AWS Config to record configuration changes to the S3 bucket and alert on any object-level modifications.