Question

During an incident investigation, a security engineer suspects that an attacker with administrative credentials may have altered or deleted CloudTrail logs to hide their activity. The organization needs to guarantee that going forward, historical CloudTrail log files can be proven unaltered and retained for forensic and legal purposes, even against an actor with account-level admin privileges. Which combination of controls BEST ensures the tamper-evidence and long-term integrity of the logs?

Accepted Answer

Enable CloudTrail log file integrity validation and deliver logs to an S3 bucket in a separate, dedicated logging account with S3 Object Lock in compliance mode and MFA delete configured.

Answer

Enable CloudTrail server-side encryption with an SSE-KMS key and restrict the key policy so only the security team can decrypt the log files.

Answer

Configure a CloudWatch Logs subscription filter to stream CloudTrail events to an OpenSearch cluster and set a 7-year index retention policy.

Answer

Turn on CloudTrail Insights and enable versioning on the log bucket so prior versions of any modified object can be restored.