Exam AWS Certified Data Engineer - Associate DEA-C01 topic 1 question 57 discussion

https://docs.aws.amazon.com/AmazonS3/latest/userguide/logging-with-S3.html Option D, creating a trail of data events in AWS CloudTrail, is the best solution to meet the requirement with the least operational effort. It directly logs the desired activities to another S3 bucket and does not involve the development and maintenance of additional resources like Lambda functions or Kinesis Data Firehose streams.

A: Don't need all activities on the S3 bucket B: Management events include not only the data log but also the admin log C: Don't need all activities on the S3 bucket Option D with the LEAST operational effort

Correct answer is D. Option A or C require writing custom Lambda code to handle the events and write them to the Kinesis or S3 bucket so they are not the LEAST operational effort.

S3 object level activities such as GetObject, DeleteObject, PutObject etc are considered as Data event in cloud trail. Read and Write event be monitored separately.

The correct answer is B - CloudTrail of management events includes logging set ups like this

Although it might be tempting going with C, please keep in mind that if we go with C we must define lambda code, lambda permission, triggers, etc. If we go with D we just enable a trail data events and that's pretty much it.

Other Options were Less Efficient: A. Leverage S3 Event Notifications, Lambda function, and Kinesis Data Firehose: While this option works, it involves setting up and managing three services, increasing complexity and operational overhead. Kinesis Data Firehose introduces an unnecessary intermediary step, adding complexity for a straightforward logging task. B. Utilize CloudTrail with Management Events: CloudTrail primarily tracks API calls and management activities related to S3 buckets, not data events like writes to objects. Consequently, it wouldn't capture the desired S3 bucket writes. D. Employ CloudTrail with Data Events: Similar to option B, CloudTrail with data events doesn't track individual object writes within a bucket. It focuses on object-level changes like creation, deletion, or metadata modification.