Using S3 Server Access Logs for Auditing
A data engineer needs to audit all access to an S3 bucket for compliance. They want to capture object-level operations such as GetObject and PutObject, as well as bucket-level operations like ListBucket. Which AWS service should be used?
Quick Answer
The answer is S3 server access logs, as they are the correct AWS service to audit S3 with server access logs for both object-level operations like GetObject and PutObject and bucket-level operations such as ListBucket. These logs provide detailed records of every request made to a bucket, capturing the action, requester, and response status, which makes them ideal for compliance auditing. On the AWS Certified Data Engineer Associate DEA-C01 exam, this question tests your ability to distinguish between S3 server access logs and CloudTrail, a common trap where candidates assume CloudTrail logs all S3 operations by default—but CloudTrail management events only cover bucket-level actions, and object-level logging requires explicitly enabling data events. Remember that S3 server access logs are a bucket-level feature you enable directly on the bucket, while CloudTrail is a separate service for API activity monitoring. A helpful memory tip: think of server access logs as the bucket’s own diary, recording every knock on the door, whereas CloudTrail is the security camera watching the building’s entrance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
S3 server access logs
S3 server access logs record both object-level operations (e.g., GetObject, PutObject) and bucket-level operations (e.g., ListBucket). AWS CloudTrail can also capture S3 API calls, but by default it logs bucket-level management events only; object-level data events must be explicitly enabled. Amazon CloudWatch Logs (Option A) is a log storage and monitoring service, not a source of S3 access logs; logs must be sent to it from another service. AWS CloudTrail management events (Option C) capture only bucket-level operations, not object-level. AWS Config (Option D) monitors resource configuration changes, not API calls. Therefore, the correct service for auditing all S3 access is S3 server access logs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon CloudWatch Logs
Why it's wrong here
CloudWatch Logs does not directly capture S3 API calls; it can be used to store logs from other sources.
- ✓
S3 server access logs
Why this is correct
S3 server access logs provide detailed records about requests made to a bucket, including object-level and bucket-level operations.
- ✗
AWS CloudTrail management events
Why it's wrong here
Management events do not include object-level operations like GetObject.
- ✗
AWS Config
Why it's wrong here
AWS Config records resource configuration changes, not API calls.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DEA-C01 question is part of Courseiva's 1,711-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DEA-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A data engineer needs to audit all access to an S3 bucket containing sensitive customer data. The engineer must record the requester, timestamp, action, and whether the access was denied. Which AWS solution meets these requirements?
medium- A.Use AWS Config to record S3 bucket-level configuration changes.
- B.Enable VPC Flow Logs for the VPC where the bucket resides.
- C.Enable AWS CloudTrail Data Events for the S3 bucket.
- ✓ D.Enable S3 server access logs for the bucket, storing them in a different bucket.
Why D: S3 server access logs capture detailed records of requests made to a bucket, including the requester, timestamp, action, and response status (e.g., whether the access was denied). These logs are stored in a designated target bucket and are specifically designed for auditing access requests. Option A is incorrect because AWS Config tracks configuration changes, not individual access requests. Option B is incorrect because VPC Flow Logs capture IP traffic metadata, not application-level S3 operations. Option C is incorrect because while AWS CloudTrail can log object-level events when Data Events are enabled, S3 server access logs are purpose-built for this auditing requirement and provide granular details out of the box without additional setup or cost beyond logging.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.