Question

A financial services company must be able to prove during audits that its AWS API activity logs have not been altered or deleted after being written. The security team already has a CloudTrail trail delivering logs to an S3 bucket, but auditors require cryptographic proof that no log files were tampered with between delivery and review. Which action provides this assurance with the least operational overhead?

Accepted Answer

Enable CloudTrail log file integrity validation, which generates digest files that let you verify whether log files were modified or deleted.

Answer

Enable S3 default encryption with SSE-KMS on the log bucket so that any unauthorized modification of log files is automatically blocked.

Answer

Turn on S3 Versioning on the log bucket and periodically compare object versions to detect changes.

Answer

Configure an AWS Config rule that checks whether CloudTrail is enabled and alerts when the trail is disabled.