Exam AWS Certified DevOps Engineer - Professional DOP-C02 topic 1 question 354 discussion

To capture API calls at object level in the Amazon S3, including calls rejected by invalid credentials, you need to enable the "data events" in AWS CloudTrail. Cloudtrail is the only service that records all API calls, including: Putobject, GetObject, Deleteobject, etc. Authorized and unauthorized calls (eg, AccessDenied error or invalidationSKeyid). Date events are required to register object level operations in S3. Sending logs to Cloudwatch allows for real -time alerts and queries (optional, but helps visibility).

Option A S3 Access Logs are great for basic access auditing and billing analysis, but they do not capture denied requests or IAM-level details. CloudTrail data events are the only service that logs both accepted and rejected S3 object-level API calls, fulfilling the security requirement.

Server access logging provides detailed records for the requests that are made to a bucket. Server access logs are useful for many applications. For example, access log information can be useful in security and access audits. This information can also help you learn about your customer base and understand your Amazon S3 bill. best practice to use a new S3 bucket: When your source bucket and destination bucket are the same bucket, additional logs are created for the logs that are written to the bucket, which creates an infinite loop of logs. We do not recommend doing this because it could result in a small increase in your storage billing. https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerLogs.html