Exam AWS Certified Security - Specialty topic 1 question 104 discussion

Answer is A You can insert logging statements into your code to help you validate that your code is working as expected. Lambda automatically integrates with Amazon CloudWatch Logs. It pushes all logs from your code to a CloudWatch Logs group that is associated with a Lambda function (/aws/lambda/<function name>). To learn more about log groups and accessing them through the CloudWatch console, see Working with Log Groups and Log Streams in the Amazon CloudWatch Logs User Guide. For information about how to access CloudWatch log entries, see Accessing Amazon CloudWatch Logs for AWS Lambda. Note If your Lambda function code is executing, but you don't see any log data being generated after several minutes, this could mean that your execution role for the Lambda function didn't grant permissions to write log data to CloudWatch Logs. For information about how to make sure that you have set up the execution role correctly to grant these permissions, see AWS Lambda Execution Role. https://docs.aws.amazon.com/lambda/latest/dg/lambda-monitoring.html

B is incorrect. API calls are also logged in cloudtrail C is incorrect. Cloudwatch is the one that writes logs to S3, not the Lambda D is incorrect. Irrelevant

Correct Answer is A Lambda execution role needs the following actions to be permitted. "logs:CreateLogGroup" "logs:CreateLogStream" "logs:PutLogEvents"

The lambda function's execution role must have sufficient permissions to write logs to CloudWatch.

answer is A

Lol I've actually experienced this problem at work. I'm pretty sure the answer is A

Ans: A 100%

A is Correct

Ans > A

Ans (A) https://docs.aws.amazon.com/lambda/latest/dg/lambda-monitoring.html

A, for sure. We can log API calls in CloudWatch logs. To help debug issues related to request execution or client access to your API, you can enable Amazon CloudWatch Logs to log API calls. https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-logging.html

A is correct

A and B looks correct !

Nobody votes for B? The lambda already altered the data, and it is asking who invoked and what was altered. So I think it should be in cloudtrail

A is the answer.

A is right

Out of the 4 options, A seems to be the most possible