AWS Certified Security Specialty SCS-C02 (SCS-C02) — Questions 76–150

For CloudTrail to encrypt log files with a customer managed KMS key, the key policy must grant the CloudTrail service principal (cloudtrail.amazonaws.com) permissions for kms:GenerateDataKey and kms:Decrypt. If these permissions are missing, CloudTrail cannot generate the data key needed to encrypt the logs, and log delivery will fail or produce unencrypted logs. This is the exact cause described in the question, making it the correct answer.

AWS CloudTrail records every CreateAccessKey management event as a CloudTrail event containing the user identity, timestamp, source IP, and request details. Amazon CloudWatch Events (now Amazon EventBridge) can evaluate those CloudTrail events with an event pattern for eventName equal to CreateAccessKey and then route the matching event to an SNS topic or Lambda function to send the alert. Together, these two services provide the required real-time, event-driven notification.

A service control policy (SCP) that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail is the correct preventive control because SCPs are account permission boundaries applied at the organization, organizational unit, or account level, and they apply to every IAM principal, including the root user. Once attached to all member accounts, it blocks these API calls before they execute, ensuring that no user or role—even with administrator privileges—can disable or delete CloudTrail. This centralizes protection and is the only option that directly prevents the malicious actions.

AWS WAF is the correct service because it attaches as a web access control list (web ACL) directly to the Application Load Balancer. You can create an IP set match rule to block the specific IPv4 or IPv6 address before the request reaches the ALB, and WAF inspects each HTTP/HTTPS request at Layer 7. It also offers managed rules, rate-based rules, and geo-matching for more granular traffic control, and its integration is a one-click attachment to ALBs.

Amazon EventBridge can receive AWS API events from CloudTrail and match a custom event pattern for the ModifyDBSnapshotAttribute API call from the rds source, then route that event to an SNS topic for immediate alerting. This gives you a near-real-time, automated response based on the exact administrative action, with no need to poll or manually review logs. Because the rule uses an event pattern keyed on the API name, it fires precisely when the snapshot attribute is modified and can be extended to trigger Lambda remediations.

Service Control Policies (SCPs) are AWS Organizations policies that centrally manage the maximum available permissions for identities and resources in member accounts. They act as guardrails that restrict what IAM users, roles, and even the root user can do in an account, without granting any permissions themselves. By attaching SCPs to accounts or organizational units, you can enforce consistent permission boundaries across the entire organization, which directly matches the requirement for central permission control.

Federated users, such as those authenticated by an external identity provider via SAML 2.0 or web identity federation, can assume an IAM role to obtain temporary AWS credentials. The user's original identity is mapped to a role, and AWS STS issues scoped, time-limited access keys that abide by the role's trust and permissions policies. This allows external identities to access AWS resources without creating an IAM user and without distributing permanent credentials.

AWS WAF web ACLs contain rules that can inspect headers and use match conditions like SQL injection. A rule to block requests missing the header enforces the header requirement, and a SQL injection match condition blocks malicious payloads. Both can be combined in a single web ACL associated with the ALB.

Yes—this is the standard pattern when you need encryption over Direct Connect. You can deploy a site-to-site VPN on a public virtual interface, or terminate a software VPN on an EC2 instance behind a private VIF, so IPsec encapsulates the IP packets and secures the entire path while still benefiting from Direct Connect's bandwidth and latency. IPsec provides authenticity, integrity, and confidentiality for all traffic, making it the appropriate answer for the stated requirement.

A permissions boundary with an explicit Deny for cloudtrail:StopLogging and Allow for required actions ensures no identity-based policy can override the deny. The boundary caps maximum permissions, so even if an administrator later attaches a broad policy, the deny remains effective. This directly enforces the requirement without blocking unrelated operations.

Forcing key-based authentication on an EC2 instance requires disabling password logins at the OpenSSH daemon level by setting 'PasswordAuthentication no' in /etc/ssh/sshd_config and restarting sshd. This directly changes how the SSH server validates users: public key cryptography becomes the only accepted method, and password prompts are no longer offered. Because sshd reads this configuration on startup, the setting takes effect for all SSH connections, making it a true enforcement mechanism rather than a workflow convenience.

AWS Certificate Manager provisions SSL/TLS certificates for public and private domains, handles domain validation via DNS or email, and automatically renews eligible certificates before expiry. It natively deploys the certificate to integrated AWS services such as Application Load Balancers, CloudFront, and API Gateway, eliminating manual installation and tracking. Because the private key is generated in and protected by AWS-managed hardware, ACM is the correct service for the stated requirement to securely store and manage SSL/TLS certificates.

Invoke events are the Lambda data-plane records logged to CloudTrail every time the function is actually called; each event captures the function name, qualifier, timestamp, request parameters, and invoking principal. Enabling data events on Lambda in a CloudTrail trail is what makes these entries appear, and they are precisely what an auditor needs to see who invoked the function and when. This is why Invoke is the correct way to audit that sensitive-data processing occurred.

An explicit Deny statement in the bucket policy takes precedence over every Allow, including the IAM role's identity-based permissions. In AWS authorization, the evaluation first defaults to deny, then any allow from identity-based or resource-based policy, but if an explicit deny exists in either policy, the final decision is deny. Thus if the bucket policy contains a statement that denies this role (or the role's account) the s3 operation, access will be blocked even though the role policy appears to grant the necessary permissions.

This policy uses a Deny effect with a condition that checks for the presence and value of the s3:x-amz-server-side-encryption header. If a PutObject request does not include the header with aws:kms, the request is denied. This enforces encryption with SSE-KMS for all uploads. It is the standard way to require a specific encryption method for objects uploaded to an S3 bucket.

Enabling S3 Object Lock in Compliance mode places a retention lock on objects until a specified date; during that retention period no user, not even the AWS account root user, can delete or overwrite them. Compliance mode is the strongest Object Lock mode because the retention protection cannot be shortened, removed, or bypassed by any principal. When used as the destination for CloudTrail logs, this guarantees the logs are retained for the full seven years and satisfies the stated requirement.

Enabling EBS encryption by default ensures that all new EBS volumes created in the Region are automatically encrypted using the default KMS key for EBS encryption. This enforces encryption at rest without requiring manual intervention for each volume. It also prevents the creation of unencrypted volumes, meeting the requirement.

Amazon CloudWatch Events (and its successor Amazon EventBridge) is correct because it can ingest CloudTrail events and apply an event pattern that matches a root user console login. A rule can specify the event source as aws.signin, the detail.eventName as ConsoleLogin, and the userIdentity.userName as root, routing matches to an SNS topic for immediate delivery. This pattern-based routing reacts in near real time, typically within seconds of the API call, and can also capture failed login attempts and MFA-related details. Since the requirement is real-time notifications for every root login, CloudWatch Events with an SNS target is exactly the alerting layer that CloudTrail alone lacks.

Specifically, SCPs can deny the CloudTrail management actions such as cloudtrail:StopLogging, cloudtrail:DeleteTrail, and cloudtrail:UpdateTrail, preventing even the root user in a member account from disabling audit logging. Because SCPs act as an overlay on all IAM identities within the affected accounts, they are an effective detective and preventive control for maintaining an immutable trail record. This is a common pattern for meeting audit and security requirements.

An IAM policy can explicitly deny ec2:RunInstances when a condition key such as ec2:RequestTag/cost-center is absent from the API request—for example, by using a Null condition set to true. Because IAM policies are evaluated before the API call is executed, any launch attempt that omits the cost-center tag is immediately rejected, before any instance is created. This is a true preventive control and is the only listed option that stops the launch itself.

This is the correct next step. Permission sets define the level of access (e.g., read-only, admin) and are assigned to IdP groups for specific AWS accounts. This leverages the group membership from the IdP to grant access without creating individual IAM users. It centralizes management and ensures that users get the right permissions in the right accounts.

Amazon GuardDuty consumes VPC DNS logs, flow logs, and other telemetry to identify suspicious behavior such as outbound traffic to known command-and-control IPs. A high-severity finding can be sent to Amazon EventBridge, which invokes an AWS Lambda function that replaces the instance's security group with a quarantine security group containing a deny-all inbound and outbound rule, instantly severing network connectivity. This agentless containment preserves the running instance and its memory for investigation and is the recommended automated isolation pattern.

Amazon GuardDuty continuously monitors CloudTrail management events, including IAM role assumptions and API activity, using machine learning and threat intelligence to detect suspicious behavior such as credential exfiltration or anomalous role usage. It generates findings that can trigger alerts via EventBridge, making it the correct choice for detecting and alerting on suspicious IAM role activity.

Unused access keys are dormant credentials that an attacker can abuse without the legitimate owner noticing, and they are frequently omitted from routine code and permission reviews. AWS provides the IAM credential report and the LastUsed timestamp for each key, so you should regularly identify keys that have not been used for 90 days and deactivate or delete them to reduce the total attack surface and simplify incident investigation.

The wrong options are eliminated because this is a Decrypt event: a user invoked the KMS Decrypt API to reveal plaintext from previously encrypted data. In an investigation, this event is significant because it shows the KMS key was used to turn ciphertext into plaintext, which is how an attacker or insider would access data after exfiltrating it. Therefore, this interpretation correctly matches the CloudTrail record and indicates a potential data disclosure.

Secrets Manager natively supports automatic rotation by invoking an AWS Lambda function that updates the secret and the database credential in a coordinated fashion. The Lambda function follows the rotation schedule you configure (for example, every 30 days) and uses staged steps to ensure the secret is valid before promoting it, while also updating the target database. This fully automates the credential lifecycle, eliminates manual intervention, and is the correct way to enforce periodic rotation for database credentials stored in Secrets Manager.

The source IP address 203.0.113.50 is recorded in the CloudTrail event as sourceIPAddress, and it originates from a geographic region outside the company's known operating footprint. Anomalous source IPs are a well-known indicator of compromised credentials or unauthorized access, especially when combined with API calls that create resources. This is the only option that represents an actual observable anomaly in the log entry itself, making it the strongest sign of suspicious activity.

Enabling CloudTrail with data events for an S3 bucket records object-level operations such as GetObject, PutObject, DeleteObject, and HeadObject, capturing the IAM principal, source IP, and whether the request succeeded or failed. This creates an authoritative, queryable audit trail that can be searched in CloudTrail Lake or Athena and is essential for incident investigation, compliance reporting, and detecting compromised credentials. Unlike server access logs, CloudTrail data events reliably include failed attempts.

Amazon CloudWatch Events (now Amazon EventBridge) is the alerting and event-routing mechanism: you can define rules that match GuardDuty findings or specific CloudTrail API calls and automatically send them to an SNS topic, Lambda function, or Systems Manager automation. For example, a rule with event source 'aws.guardduty' and detail-type 'GuardDuty Finding' can trigger an SNS notification whenever a suspicious finding is generated. This makes CloudWatch Events the delivery/alerting layer in a detection pipeline, not a source of security data itself.

SCPs can be attached to OUs to centrally restrict permissions.

Attaching the SCP to the root organizational unit places it in the hierarchy of every OU and member account in the organization, so the deny rule with aws:MultiFactorAuthPresent applies to every IAM user in those accounts. Because a root-level SCP is evaluated as an organizational permission boundary before IAM authorization, an IAM action without MFA is blocked throughout the member accounts.

The aws:PrincipalArn condition key matches the full ARN of the IAM principal (user or role) that is making the request. For a VPC endpoint policy controlling access to Amazon S3, you can specify a role ARN as the value, ensuring only requests signed with that role's credentials are allowed through the endpoint. This is the correct way to restrict access to a specific IAM role because it directly inspects the principal identity rather than the network source.

AWS Secrets Manager automatically rotates secrets, including IAM user access keys, using a Lambda function built-in or custom. It can store the secret as AWSCURRENT and manage rotations with defined schedules, and also provides access policy and audit capabilities. This makes Secrets Manager the correct service for centrally managing and rotating IAM access keys.

A service control policy (SCP) acts as a permission boundary for all IAM principals in an AWS account. In this scenario, the SCP's condition was written with incorrect scoping—it likely used a condition key that did not match the SecurityAdminRole's principal ARN, or failed to include an exclusion for that role—so the explicit deny in the SCP applied to every principal, including SecurityAdminRole. Because an explicit deny in an SCP overrides any allow from an identity-based policy, the role's IAM permission to call cloudtrail:StopLogging was ineffective, leaving the deny intact and blocking the stop action.

This architecture correctly places the web servers in private subnets with a 0.0.0.0/0 route to a NAT gateway in public subnets, so the web servers can download patches and updates but cannot be directly reached from the internet. The database servers are in separate private subnets with no route to the NAT gateway or to an internet gateway, giving them no internet path at all—protecting against both inbound attacks and outbound data exfiltration. The internet-facing Application Load Balancer resides in public subnets, accepts HTTPS traffic on port 443, terminates TLS, and forwards requests to the web servers over private IPs, while the web servers communicate with the database over the VPC internal network only.

AWS Config rules evaluate resource configurations against desired policies and, when a rule is noncompliant, can trigger an associated AWS Systems Manager Automation runbook to automatically perform the necessary corrective action. This combination of continuous evaluation and auto-remediation directly addresses the need to automate enforcement of security best practices. For example, a Config rule can detect an S3 bucket without encryption and invoke an Automation document to enable default encryption, all without manual intervention.

IAM policies are the primary identity-based access control in AWS. They allow you to grant specific principals, such as IAM users or roles, explicit Allow or Deny permissions for S3 actions on a given bucket and its objects. When combined with resource-based bucket policies, IAM enables fine-grained authorization, such as requiring s3:GetObject only for certain prefixes, which directly prevents unauthorized access to sensitive data.

CloudTrail data events for S3 capture object-level API calls such as GetObject, PutObject, and ListBucket, recording the IAM principal, source IP address, timestamp, and specific request parameters. Unlike management events, data events require explicit enablement on the trail or bucket, but once enabled they provide queryable, near real-time records of exactly the operations an attacker would perform to extract data. This gives investigators the necessary combination of user identity, network origin, and object-level action to confirm or refute exfiltration, making it the correct choice.

This is the correct minimum-privilege policy because it grants exactly the three write actions required for access key rotation: 'iam:CreateAccessKey' to generate a new key pair, 'iam:UpdateAccessKey' to change the old key's status to Inactive, and 'iam:DeleteAccessKey' to remove the old key. The resource ARN 'arn:aws:iam::*:user/${aws:username}' uses the policy variable '${aws:username}', which is dynamically replaced with the caller's IAM user name, so each user can only manage their own access keys. This adheres to least privilege and is the AWS-recommended pattern for self-service key rotation.

RDS encryption at rest uses AWS KMS envelope encryption, where a customer master key (CMK) encrypts the data keys that encrypt your database storage, automated backups, snapshots, and read replicas. If the underlying EBS volumes are compromised, the encrypted data remains unreadable without KMS key access, and you also get a compliance benefit. Note that you must enable encryption at launch because you cannot encrypt an existing unencrypted RDS instance in place.

Creating an IAM role with the necessary S3 permissions and attaching it as an instance profile is the AWS-recommended best practice. The EC2 instance receives temporary security credentials through the instance metadata service (IMDS), and the AWS SDKs automatically retrieve and refresh those credentials before they expire. This avoids storing any long-term keys on the instance, enforces least-privilege permissions scoped to the role, and gives you automatic rotation without manual intervention.

Referencing the ALB's security group as the source in the instance security group rule limits inbound HTTP to traffic originating from the elastic network interfaces that actually belong to the ALB nodes. This SG-to-SG association follows the ALB as it scales or replaces its ENIs across Availability Zones, because any ENI that is a member of the ALB security group is automatically allowed. It is the recommended, least-privilege approach for placing an EC2 instance behind an Application Load Balancer.

The IAM Credential Report lists every user's password and access key usage with timestamps, letting the engineer identify accounts with no activity for 90 days and then disable them. It provides the credential-age and last-used data the scenario requires.

The upload fails because the Deny statement is explicit and takes precedence over any Allow. Since the request either omits the encryption header or uses a different value (e.g., aws:kms), the Deny's StringNotEquals condition matches, and IAM denies s3:PutObject before the Allow can be evaluated. This is the only correct outcome.

A KMS key policy is a resource-based policy that defines which principals may use that key, and it must explicitly grant the decrypt permission to John. Even with admin IAM permissions, if John isn't listed as a principal in the key policy, AWS KMS denies the decryption call with AccessDenied. The correction is to add John as a principal with kms:Decrypt action in the key policy or configure the key policy to allow IAM policies, then keep his IAM permission.

An instance profile delivers temporary, automatically rotated credentials to the EC2 instance through the instance metadata service, so no long-term access keys are stored on disk. The attached IAM role scopes S3 permissions precisely, satisfying the requirement to avoid embedded credentials.

AWS Firewall Manager is the correct service for centrally managing security group rules across all accounts in an AWS Organization. You can create a security group policy that defines baseline ingress/egress rules, and Firewall Manager automatically applies that policy to compliant and non-compliant resources in every member account, including new accounts added later. This is proactive enforcement, not just detection, and it also supports audit policies that continuously check and report security group drift.

AWS managed keys are KMS keys created automatically when a service first needs encryption, and Amazon RDS's AWS managed key (alias aws/rds) has automatic rotation enabled by default, rotating the backing key material every year. Because the key is managed in the AWS account's service space, you cannot disable rotation, which neatly matches a requirement for guaranteed automatic rotation without any administrative action.

AWS Config continuously records resource configurations and evaluates them against managed or custom rules, such as the required-tags rule that checks for specific tag keys. When a resource becomes noncompliant, Config can invoke remediation actions via Systems Manager Automation documents or Lambda functions, such as adding the missing tag automatically. This makes it the correct service for both detecting missing tags and automating their correction.

Long-term IAM user credentials, an access key ID and secret access key, are the canonical way to sign AWS API requests via Signature Version 4. These credentials are used for programmatic access through the AWS CLI, SDKs, or direct HTTP calls, and must be protected with least-privilege IAM policies and rotated regularly because they do not expire by default.

A route table entry for 0.0.0.0/0 targeting the Internet Gateway (IGW) is the core routing mechanism that makes a subnet public. Without this default route, the IGW exists but traffic from the subnet cannot reach it; the VPC's implicit local route only handles VPC-internal traffic. This route is required for the web server to receive inbound HTTP/HTTPS from the internet and to send responses back, making it a mandatory component of a public subnet design.

A service control policy (SCP) is an organizational policy that specifies the maximum allowed permissions for all principals, including the root user, in every account governed by an AWS Organizations hierarchy. Attaching an SCP that explicitly denies iam:CreateUser to the organization root or a specific OU prevents any principal in those accounts from creating IAM users, regardless of the permissions granted by IAM policies. Because all features are enabled, the SCP is enforced globally across member accounts, making it a true preventive control.

CloudTrail trails are scoped to a single Region unless they are organization trails or you have configured aggregation. If the CLI command ran in a different Region than where the key pair was created, the CreateKeyPair event would be delivered to the trail in the creation Region, not the one the engineer queried. The engineer would see nothing, not because the event wasn't recorded, but because they were looking in the wrong regional trail.

Creating an interface VPC endpoint for AWS KMS allows KMS API calls from your VPC to reach the service without traversing the public internet. The definitive control is to modify the KMS key policy to include a condition such as "aws:sourceVpce": "vpce-1234567890abcdef0" in the Allow statement, so that only requests that arrive through that specific VPC endpoint can use the key. This works because KMS evaluates the key policy with the sourceVpce context key, and requests that do not originate from the designated endpoint are implicitly denied, while requests from an EC2 instance or private subnet using the endpoint are allowed. The key policy must include the principal (e.g., the IAM role/account root) and the restriction to the VPC endpoint, because the VPC endpoint itself is the enforcement point that KMS trusts.

The security group acts as a stateful, allow-only firewall at the instance level. Removing the inbound SSH rule for 0.0.0.0/0 immediately denies all internet SSH traffic while leaving the HTTP rule intact. Since security groups contain no explicit deny rules, the absence of an allow rule is what blocks the connection. This is the precise, least-disruptive change because it only restricts SSH and does not affect HTTP reachability.

The AWS Encryption SDK uses envelope encryption: it generates a data key, encrypts the file with that data key, and encrypts the data key with the KMS customer managed key. Only the small data key is sent to KMS, minimizing data transfer. The encrypted file and encrypted data key are stored together. This meets the requirement to minimize data sent to KMS.

A VPC Gateway Endpoint for DynamoDB is a logical gateway object added to the VPC route table, allowing instances to reach DynamoDB via AWS's private network without attaching an internet gateway or NAT device. It works by adding an entry to the route table that points DynamoDB's prefix list to the endpoint, and it supports IAM policies on the endpoint itself to restrict access. This is the recommended, private, and cost-effective solution for an EC2 instance to access DynamoDB securely and is the correct answer.

AWS CloudTrail captures management events, including the CreateAccessKey API call, and can be configured to deliver those events to Amazon CloudWatch Logs. In CloudWatch Logs, a metric filter with a pattern like 'eventName: CreateAccessKey' creates a custom metric; a CloudWatch alarm on that metric then publishes a message to an SNS topic, which sends email or SMS notifications. This combination provides real-time alerting for the exact IAM event, making it the correct architecture.

AWS CloudTrail is the authoritative audit service for API activity in AWS, and it records RunInstances as a management event. Each CloudTrail event includes the userIdentity object with the IAM principal, role, or assumed-role session, along with sourceIPAddress, eventTime, userAgent, requestParameters, and responseElements containing the new instance IDs. By searching CloudTrail logs for RunInstances events, the security engineer can directly identify which IAM user or role launched the instance, enabling attribution and further investigation of the alleged data exfiltration.

Detaching from the Auto Scaling group prevents termination or replacement during acquisition, while security group changes isolate the instance from further compromise. Systems Manager Run Command then executes the memory capture tool without needing SSH access, preserving volatile data that would be lost on stop or reboot.

AWS Config continuously records resource configuration changes and evaluates them against managed or custom rules to determine compliance. When a resource drifts from the required policy, AWS Config can invoke an AWS Lambda function as a remediation action, which can automatically apply corrective changes such as updating security groups, enabling encryption, or deleting orphaned resources. This combination provides both the compliance evaluation and the automatic remediation needed for a central management system, making it the correct choice.

The request is denied because the condition matches — i.e., the request was made over plain HTTP, so the aws:SecureTransport boolean value is false, causing the condition "Bool": {"aws:SecureTransport": "false"} to evaluate true. When the Deny statement's condition is satisfied, the explicit deny overrides any Allow, so S3 returns 403 AccessDenied. The resource ARN covering the object bucket is also broad, but that is not the operative issue.

Amazon GuardDuty is a managed threat detection service that continuously analyzes CloudTrail event logs, VPC Flow Logs, and DNS query logs using machine learning models and integrated threat intelligence to identify anomalous IAM behavior. It establishes a baseline of normal user activity and generates findings when it detects deviations, such as a logon from a known malicious IP, an unusual geolocation sign-in, or API calls made from a compromised credential. GuardDuty is purpose-built to alert on these anomalies and can automatically send findings to Amazon EventBridge for response.

Object Lock prevents log deletion or modification.

IAM roles support cross-account access by allowing a principal from another AWS account to assume the role, provided the role's trust policy explicitly lists that account as a trusted entity. Once assumed, the principal gains the permissions attached to the role, enabling secure federation between accounts without sharing long-term credentials. This is a common pattern for centralized management or delegated administrative tasks across AWS environments.

A strong password policy enforces length, complexity and rotation, reducing credential-guessing and brute-force success against IAM users. It satisfies the stem's best-practise criterion by hardening the primary authentication secret before other controls are layered on.

Adding a bucket policy that explicitly allows the IAM role to perform s3:PutObject is a correct and often necessary step because S3 uses resource-based policies to control access at the bucket level. Even if the role has an identity-based policy permitting s3:PutObject, a bucket policy can grant the role as an explicit principal, which is particularly important in cross-account scenarios or when the bucket's AWS account uses S3 bucket owner enforced settings. In a same-account setup, this policy and the role policy work together to ensure the API call is allowed under the S3 policy evaluation model.

Setting up an IPsec VPN over the Direct Connect private VIF encapsulates all IP traffic between your on-premises network and the VPC, providing network-layer confidentiality and integrity while still using the private, low-latency Direct Connect path. IPsec operates at Layer 3, so it secures every protocol and service traversing the link, not just specific applications, and it is the standard way to add encryption because Direct Connect does not encrypt traffic natively. The VPN tunnel rides inside the private VIF, so you retain the dedicated bandwidth and avoid the public internet.

Amazon EventBridge is the correct entry point because GuardDuty publishes every finding to the default event bus as an event with a detail-type such as 'GuardDuty Finding'. A rule can filter on finding severity, account, or region and immediately invoke a Step Functions state machine or Lambda function, enabling real-time, event-driven response. Without EventBridge, you would have to poll the GuardDuty API, which introduces latency and bypasses the native event pattern that AWS services emit.

Amazon GuardDuty is a threat detection service that continuously monitors for malicious and unauthorized behavior using integrated threat intelligence and machine learning. It ingests S3 data events from CloudTrail, as well as VPC flow logs and DNS logs, to identify anomalies like unusual access patterns, credential compromise, or suspicious source IPs. GuardDuty generates findings in near real time, making it the appropriate service for detecting unauthorized access attempts to S3.

AWS Config continuously records the configuration state of your S3 bucket and evaluates it against managed rules such as s3-bucket-public-read-prohibited, s3-bucket-encryption-enabled, and s3-bucket-versioning-enabled. When a bucket configuration drifts from the expected baseline, AWS Config marks the resource noncompliant and can trigger remediation via Systems Manager Automation or alert you through Amazon SNS. This native configuration governance is precisely what is needed to ensure the bucket remains compliant, not merely observed or protected.

Amazon Kinesis Data Analytics continuously processes streaming logs using SQL or Apache Flink, allowing pattern matching, anomaly detection, and aggregation over sliding windows in near-real-time—latency can be under a few seconds. It can output its results to a Lambda function (via a Kinesis Data Analytics destination or an intermediate Kinesis Data Stream) which then executes an automated response (e.g., updating security groups, invoking AWS WAF, or sending alerts). This stream-processing architecture directly meets the 'detect and respond' requirement with minimal delay, unlike batch-based alternatives.

SCPs act as permission boundaries and never grant permissions; they only filter the actions that IAM policies allow. If an SCP contains only Deny statements and no Allow statement permitting EC2 actions, the implicit default deny applies to every EC2 API call, regardless of what IAM identity-based policies grant. This is why the policy denies all EC2 actions.

Kinesis Data Streams provides durable, real-time ingestion for log data arriving from multiple sources, and Kinesis Data Firehose can buffer, transform, and deliver that data to multiple destinations such as Amazon S3, Redshift, or OpenSearch. The integration is the core of a managed log pipeline, enabling both real-time processing via stream consumers and reliable batch delivery. This directly addresses the need to collect and analyze logs from multiple sources.