How to log S3 bucket writes to another bucket with least effort?

Prepare logs for audit.

Answer Correct answer: D — Create a CloudTrail trail for S3 data events on the transactions bucket with write-only events and send it to the logs S3 bucket.

A company stores details about transactions in an Amazon S3 bucket. The company wants to log all writes to the S3 bucket into another S3 bucket that is in the same AWS Region. Which solution will meet this requirement with the LEAST operational effort?

Configure an S3 Event Notifications rule for all activities on the transactions S3 bucket to invoke an AWS Lambda function. Program the Lambda function to write the event to Amazon Kinesis Data Firehose. Configure Kinesis Data Firehose to write the event to the logs S3 bucket.
Create a trail of management events in AWS CloudTraiL. Configure the trail to receive data from the transactions S3 bucket. Specify an empty prefix and write-only events. Specify the logs S3 bucket as the destination bucket.
Configure an S3 Event Notifications rule for all activities on the transactions S3 bucket to invoke an AWS Lambda function. Program the Lambda function to write the events to the logs S3 bucket.
Create a trail of data events in AWS CloudTraiL. Configure the trail to receive data from the transactions S3 bucket. Specify an empty prefix and write-only events. Specify the logs S3 bucket as the destination bucket. Correct Answer

Community Votes

100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

This item tests CloudTrail data events versus a Lambda-based S3 Event Notifications pipeline, and the trap is selecting the familiar but code-heavy notification option.

Logging all writes to an Amazon S3 bucket can be handled by AWS CloudTrail data events instead of custom S3 event notification and Lambda code. The page establishes D as the least-operational-effort solution for delivering write events to another S3 bucket in the same Region.

The most common wrong answer is C, an S3 Event Notifications rule that invokes Lambda to write events to the logs bucket, because it requires custom code, permissions, and ongoing maintenance that CloudTrail data events avoid.

Community Discussion (7 comments)

rralucard_ 👍 5 Selected: D

https://docs.aws.amazon.com/AmazonS3/latest/userguide/logging-with-S3.html Option D, creating a trail of data events in AWS CloudTrail, is the best solution to meet the requirement with the least operational effort. It directly logs the desired activities to another S3 bucket and does not involve the development and maintenance of additional resources like Lambda functions or Kinesis Data Firehose streams.

VerRi 👍 5 Selected: D

A: Don't need all activities on the S3 bucket B: Management events include not only the data log but also the admin log C: Don't need all activities on the S3 bucket Option D with the LEAST operational effort

khchan123 👍 3 Selected: D

Correct answer is D. Option A or C require writing custom Lambda code to handle the events and write them to the Kinesis or S3 bucket so they are not the LEAST operational effort.

LanoraMoe 👍 1

S3 object level activities such as GetObject, DeleteObject, PutObject etc are considered as Data event in cloud trail. Read and Write event be monitored separately.

okechi 👍 1

The correct answer is B - CloudTrail of management events includes logging set ups like this

GiorgioGss 👍 3

Although it might be tempting going with C, please keep in mind that if we go with C we must define lambda code, lambda permission, triggers, etc. If we go with D we just enable a trail data events and that's pretty much it.

Felix_G 👍 2

Other Options were Less Efficient: A. Leverage S3 Event Notifications, Lambda function, and Kinesis Data Firehose: While this option works, it involves setting up and managing three services, increasing complexity and operational overhead. Kinesis Data Firehose introduces an unnecessary intermediary step, adding complexity for a straightforward logging task. B. Utilize CloudTrail with Management Events: CloudTrail primarily tracks API calls and management activities related to S3 buckets, not data events like writes to objects. Consequently, it wouldn't capture the desired S3 bucket writes. D. Employ CloudTrail with Data Events: Similar to option B, CloudTrail with data events doesn't track individual object writes within a bucket. It focuses on object-level changes like creation, deletion, or metadata modification.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Option D uses a CloudTrail trail configured for S3 data events on the transactions bucket, with an empty prefix so all objects are covered and write-only events so only writes are logged. CloudTrail delivers those events to the specified logs S3 bucket, satisfying the same-Region destination requirement without custom code. Because CloudTrail is a managed audit logging service, enabling the trail is the least operational effort compared with building and maintaining an event-processing pipeline. The requirement is specifically for writes, and CloudTrail data events can be filtered to write-only activity.

Why the Other Options Are Wrong

Option A adds S3 Event Notifications, Lambda, and Kinesis Data Firehose, which is more moving parts and operational overhead than a CloudTrail trail, and it logs all configured activities rather than write-only events. Option B uses management events, which do not capture S3 object-level PutObject writes; management events cover control-plane actions such as bucket configuration changes. Option C also depends on a Lambda function and custom code to write to the logs bucket, so it is not the least operational effort and introduces permissions and code maintenance. Only D directly captures S3 object write data events with CloudTrail's managed delivery to an S3 destination.

Community Comment Notes

rralucard_ linked the S3 logging documentation and described D as directly logging the desired activities without developing or maintaining Lambda or Firehose resources. khchan123 likewise noted that A and C “require writing custom Lambda code to handle the events,” which is why they are not least operational effort. GiorgioGss warned that choosing C means defining Lambda code, permissions, and triggers, whereas D just enables a trail for data events. LanoraMoe clarified that S3 object-level actions such as PutObject and DeleteObject are CloudTrail data events, supporting the need for D rather than B.

Official Reference

Exam Strategy

When a question asks for the LEAST operational effort, avoid multi-service Lambda pipelines unless no managed option can meet the requirement. Confirm whether the needed S3 activity is object-level data events, then choose the CloudTrail trail with write-only data events and an S3 destination.

Frequently Asked Questions

Why is an S3 Event Notifications rule with Lambda not the least-effort choice?

It requires custom Lambda code, IAM permissions, triggers, and ongoing maintenance, while CloudTrail data events provide managed delivery to the logs S3 bucket.

Do CloudTrail management events capture S3 PutObject writes?

No. S3 object-level actions such as PutObject are data events, so a trail must be configured for data events on the transactions bucket.

More DEA-C01 FAQ →

Related Analysis

Practice All DEA-C01 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DEA-C01 Practice Test →

← Back to DEA-C01 Study Guide