QuestionQ193
Data Security and GovernanceA company keeps its processed data in an S3 bucket. The company enforces a strict data-access policy and uses IAM roles to provide its teams with varying levels of access to the S3 bucket.
The company needs notifications whenever a user breaches the data-access policy. Every notification must contain the username of the user who breached the policy.
Which solution meets these requirements?
- A Use AWS Config rules to detect violations of the data access policy. Set up compliance alarms.
- B Use Amazon CloudWatch metrics to gather object-level metrics. Set up CloudWatch alarms.
- C Use AWS CloudTrail to track object-level events for the S3 bucket. Forward events to Amazon CloudWatch to set up CloudWatch alarms.
- D Use Amazon S3 server access logs to monitor access to the bucket. Forward the access logs to an Amazon CloudWatch log group. Use metric filters on the log group to set up CloudWatch alarms.
Community Discussion