A company uses AWS Organizations with a management account and multiple member accounts. The management account has a trail in AWS CloudTrail that logs all management events for all accounts. The security team wants to also log data events for S3 buckets across all accounts. They create a new trail in the management account with data events enabled for all S3 buckets in all accounts. However, data events from member accounts are not appearing in the CloudTrail logs. What is the most likely cause?

Question

Accepted Answer

Data events for S3 buckets are not logged centrally by a trail created in the management account; each account must have its own trail for data events.. A trail created in the management account of AWS Organizations can log management events for all member accounts, but data events (such as S3 object-level operations) are logged only for the account that owns the trail. To capture data events from member accounts, each member account must create its own trail and enable data event logging for its S3 buckets. Option A is incorrect because CloudTrail can write to an S3 bucket even without a bucket policy, as long as the bucket is in the same account. Option B is incorrect because the trail was configured to log data events for all S3 buckets, but that setting only applies to the management account, not member accounts. Option D is incorrect because KMS encryption does not affect the ability to log data events; CloudTrail can use the appropriate KMS permissions if configured.

Answer

The S3 bucket in the management account does not have a bucket policy that allows CloudTrail to write logs from member accounts.

Answer

The trail is not configured to log data events for all S3 buckets; it only logs for specific buckets.

Answer

The S3 bucket is encrypted with a KMS key that CloudTrail does not have permission to use.

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

SAP-C02 Practice Question: Design Solutions for Organizational Complexity

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question