Exam AWS Certified Security - Specialty topic 1 question 217 discussion

A and B. A: The SQS queue is subscribed to the SNS topic, so the topic will need permission to send messages to the queue. B: S3 object creation notifications are sent to the SNS topic, therefore the topic's resource policy must allow S3 to publish messages. D: The bucket policy will need to allow CloudTrail to write logs. This is the first thing that should be checked.

A. https://docs.aws.amazon.com/sns/latest/dg/sns-access-policy-use-cases.html#sns-publish-messages-to-sqs-queue "Action": ["sqs:SendMessage"], B. https://docs.aws.amazon.com/AmazonS3/latest/userguide/grant-destinations-permissions-to-s3.html "Action": [ "SNS:Publish" D. https://docs.aws.amazon.com/awscloudtrail/latest/userguide/create-s3-bucket-policy-for-cloudtrail.html "Action": "s3:PutObject",

ABD are correct.

The SQS queue does not allow the SQS:SendMessage action from the SNS topic. If the SQS queue does not have the necessary permissions to receive messages from the SNS topic, it will not be able to receive new CloudTrail logs. So, Option A is correct. The SNS topic does not allow the SNS:Publish action from Amazon S3. If the SNS topic does not have the necessary permissions to receive messages from Amazon S3, it will not be able to forward these messages to the SQS queue. So, Option B is correct. The IAM role used by the SIEM tool does not allow the SQS:DeleteMessage action. After the SIEM tool reads a message from the SQS queue, it needs to delete that message to prevent it from being read again. If the IAM role does not have this permission, the SIEM tool will not be able to delete messages from the SQS queue, which could cause issues. So, Option F is correct. A B F

A. The SQS queue does not allow the SQS:SendMessage action from the SNS topic. If the SQS queue's policy does not allow the SQS:SendMessage action from the SNS topic, the messages won't be delivered to the queue. Therefore, the SIEM tool won't have any new messages to fetch. D. The S3 bucket policy does not allow CloudTrail to perform the PutObject action. If the S3 bucket policy does not grant CloudTrail the permission to perform the PutObject action, CloudTrail won't be able to write logs to the S3 bucket. As a result, the S3 bucket cannot send any new object created event notifications to the SNS topic, which in turn would prevent the SQS queue from receiving new messages. F. The IAM role used by the SIEM tool does not allow the SQS:DeleteMessage action.

BEF focuses on the permissions related to the IAM role used by the SIEM tool and the SNS topic's ability to deliver raw messages to the SQS queue BAD focuses on the permissions related to the SNS topic, the SQS queue, and the S3 bucket policy If the issue is related to the IAM role used by the SIEM tool or the delivery of raw messages from the SNS topic to the SQS queue, then BEF would be the better combination. If the issue is related to the permissions of the SNS topic, the SQS queue, or the S3 bucket policy, then BAD would be the better combination. Without more specific information about the nature of the issue, it's difficult to definitively say which combination is better.

A,E,F Possible causes of this issue are: A. The SQS queue does not allow the SQS:SendMessage action from the SNS topic. E. The IAM role used by the SIEM tool does not have permission to subscribe to the SNS topic. F. The IAM role used by the SIEM tool does not allow the SQS:DeleteMessage action. Explanation: A. The SQS queue must be configured to allow the SendMessage action from the SNS topic to receive new messages. E. The IAM role used by the SIEM tool must have permission to subscribe to the SNS topic to receive new messages. F. The IAM role used by the SIEM tool must have permission to delete messages from the SQS queue after processing them to avoid receiving duplicate messages. If the DeleteMessage action is not allowed, messages may be repeatedly processed, causing the SIEM tool to stop receiving new logs. The other options are not relevant to the issue described.

ABD is correct

A. The SQS queue does not allow the SQS:SendMessage action from the SNS topic. B. The SNS topic does not allow the SNS:Publish action from Amazon S3. D. The S3 bucket policy does not allow CloudTrail to perform the PutObject action.

The whole flow like this: CloudTrail -> S3 (Object-created event) -> SNS topic ->SQS <- SIEM (poll by IAM role)

B,D, E

A, B and D

A.B.D.