How to log all S3 access and alert on delete events?
Short answer
A Enable S3 server access logging for the audit trail and an S3 event notification to Amazon SNS filtered to DeleteObject for immediate delete alerts.
Question
Which solution will meet these requirements?
Key Takeaways
The question tests the distinction between S3 access audit logging and event-driven delete alerting; the trap is substituting daily EC2 log scans or indirect CloudWatch alarms for native S3 event notifications.
S3 server access logging captures every request made to a bucket, while S3 event notifications to Amazon SNS deliver near-real-time DeleteObject alerts. This page establishes that option A meets both the audit-logging and immediate risk-team notification requirements.
Common mistake: A frequent mistake is choosing option C, assuming CloudWatch Logs and alarms are the native path for S3 delete alerts, but they require extra CloudTrail data-event and metric-filter setup and are not the direct immediate notification mechanism shown in option A.
Expert Analysis
Why the Answer Is Correct
Option A satisfies both requirements with native S3 features. S3 server access logging records all requests made to the bucket, providing the audit trail the company needs. S3 event notifications can publish DeleteObject events to an Amazon SNS topic, giving the risk team immediate, event-driven notification rather than daily polling. This combination is the standard AWS pattern for bucket-level access auditing plus real-time delete alerting.
Why the Other Options Are Wrong
Option B also enables server access logging, but its EC2 cron job downloads logs only once per day, so delete alerts are not immediate and the custom scanner adds unnecessary operational overhead. Option C proposes CloudWatch Logs and CloudWatch alarms; S3 server access logs do not natively flow to CloudWatch Logs, and object-level delete alarms generally require CloudTrail data events plus metric filters, which is more indirect and does not by itself log all access attempts. Option D has the same daily EC2 comparison flaw as B and does not provide immediate notification, while also relying on bucket inventory comparisons rather than S3 event notifications.
Community Comment Notes
Bad_Mat's comment aligns with the correct design, stating "The correct solution is A." and summarizing the S3 server access logging plus SNS DeleteObject notification approach. The comment does not raise a competing technical objection, so it supports the native event-driven solution rather than the daily log-scanning alternatives. No other commenter on the page proposes a different mechanism.
Official Reference
- https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerLogs.html
- https://docs.aws.amazon.com/AmazonS3/latest/userguide/EventNotifications.html
These links open the official vendor documentation in a new tab.
Exam Strategy
When a requirement says immediate notification, eliminate polling designs such as EC2 cron jobs or daily log scans before evaluating other options. Then verify that the chosen AWS service is native to the resource, here S3 event notifications to SNS filtered to DeleteObject, and that the audit log requirement is handled separately by server access logging.
Frequently Asked Questions
Why isn't CloudWatch Logs with an alarm the best fit for immediate S3 delete alerts?
Does S3 server access logging alone meet the immediate delete notification requirement?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
Bad_Mat 👍 1 Answered AThe correct solution is A.A. Enable S3 server access logging for audit logs. Set up an Amazon SNS notification for the S3 bucket. Select DeleteObject for the event type for the alert system
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SOA-C03 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SOA-C03 Practice Test →