Question

A security engineer needs to prove which IAM principals read individual objects from a highly sensitive S3 bucket named 'legal-contracts'. After enabling a multi-region CloudTrail trail, the engineer notices that GetObject and PutObject API calls for the bucket do not appear in the CloudTrail logs, although CreateBucket and PutBucketPolicy calls are present. What is the correct action to capture the required object-level activity?

Accepted Answer

Configure S3 data events in the CloudTrail trail, scoped to the 'legal-contracts' bucket, and specify read and write event types.

Answer

Enable S3 server access logging on the 'legal-contracts' bucket and deliver logs to CloudTrail.

Answer

Enable CloudTrail Insights events on the trail to automatically detect object-level anomalies.

Answer

Turn on VPC Flow Logs for the subnet where the S3 gateway endpoint resides to record object access.