How to log all S3 access and alert on delete events?
A company stores sensitive data in an Amazon S3 bucket. The company must log all access attempts to the S3 bucket. The company's risk team must receive immediate notification about any delete events. Which solution will meet these requirements?
Community Insight
The question tests the distinction between S3 access audit logging and event-driven delete alerting; the trap is substituting daily EC2 log scans or indirect CloudWatch alarms for native S3 event notifications.
S3 server access logging captures every request made to a bucket, while S3 event notifications to Amazon SNS deliver near-real-time DeleteObject alerts. This page establishes that option A meets both the audit-logging and immediate risk-team notification requirements.
A frequent mistake is choosing option C, assuming CloudWatch Logs and alarms are the native path for S3 delete alerts, but they require extra CloudTrail data-event and metric-filter setup and are not the direct immediate notification mechanism shown in option A.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option A satisfies both requirements with native S3 features. S3 server access logging records all requests made to the bucket, providing the audit trail the company needs. S3 event notifications can publish DeleteObject events to an Amazon SNS topic, giving the risk team immediate, event-driven notification rather than daily polling. This combination is the standard AWS pattern for bucket-level access auditing plus real-time delete alerting.Why the Other Options Are Wrong
Option B also enables server access logging, but its EC2 cron job downloads logs only once per day, so delete alerts are not immediate and the custom scanner adds unnecessary operational overhead. Option C proposes CloudWatch Logs and CloudWatch alarms; S3 server access logs do not natively flow to CloudWatch Logs, and object-level delete alarms generally require CloudTrail data events plus metric filters, which is more indirect and does not by itself log all access attempts. Option D has the same daily EC2 comparison flaw as B and does not provide immediate notification, while also relying on bucket inventory comparisons rather than S3 event notifications.Community Comment Notes
Bad_Mat's comment aligns with the correct design, stating "The correct solution is A." and summarizing the S3 server access logging plus SNS DeleteObject notification approach. The comment does not raise a competing technical objection, so it supports the native event-driven solution rather than the daily log-scanning alternatives. No other commenter on the page proposes a different mechanism.Official Reference
Exam Strategy
When a requirement says immediate notification, eliminate polling designs such as EC2 cron jobs or daily log scans before evaluating other options. Then verify that the chosen AWS service is native to the resource, here S3 event notifications to SNS filtered to DeleteObject, and that the audit log requirement is handled separately by server access logging.
Frequently Asked Questions
Why isn't CloudWatch Logs with an alarm the best fit for immediate S3 delete alerts?
S3 event notifications to SNS are native and near-real-time for DeleteObject, while CloudWatch alarms require additional CloudTrail data-event and metric-filter setup to observe object deletes.
Does S3 server access logging alone meet the immediate delete notification requirement?
No; server access logging records requests to the bucket, but log delivery is not a real-time push. The risk team needs S3 event notifications to SNS filtered to DeleteObject for immediate alerts.
Related Analysis
Practice All SOA-C03 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SOA-C03 Practice Test →