AWS Certified Security Specialty SCS-C02 (SCS-C02) — Questions 601–675

AWS CloudTrail is the only service that directly records AWS API activity as first-class audit log events. When enabled, it captures the identity of the caller (IAM user or role), the source IP address, the requested action, request parameters, and the response returned by the service, for both management events and (when configured) data events. These logs can be delivered to Amazon S3 and CloudWatch Logs, and the trail can be multi-region and organization-wide, making CloudTrail the authoritative record of every API call for incident response and governance. Unlike anomaly-detection services such as GuardDuty, CloudTrail does not infer or analyze behavior—it simply logs each call exactly as it occurred.

A single-region trail only records management events that occur in the same region where the trail is defined. Events happening in other regions are not captured at all unless the trail is configured as a multi-region trail, which creates equivalent trails in every region. Since the security team is investigating events from another region, the lack of a multi-region configuration directly explains the gap.

AWS Systems Manager Run Command is the correct choice because it executes an arbitrary command (shell or PowerShell) on one or more managed instances through the SSM Agent and can immediately write the output to Amazon S3. It supports tag-based targeting, returns status and response details, and offers low latency—critical for incident response. Storing the output to S3 provides a persistent and auditable record for later analysis, while the same command can be fanned out to a fleet in parallel.

Security groups are stateful, instance-level firewalls, so modifying the security group attached to the instance to revoke all outbound rules will immediately block the compromised instance's egress traffic without affecting other instances in the subnet. Changes apply instantly to the ENI, and because security groups are scoped to the instance, this provides precise, surgical isolation. This is the fastest way to stop malicious outbound communication while preserving the instance for investigation.

The missing permission is s3:GetBucketAcl, and without it CloudTrail will reject the bucket even though PutObject is allowed. Before writing its first log, CloudTrail calls GetBucketAcl on the destination bucket to confirm the bucket's owner, and the bucket policy must explicitly grant that action to the cloudtrail service principal. If the bucket ACL check fails, CloudTrail returns an error such as 'bucket does not exist or bucket ACL does not allow access' and log delivery halts. This permission is a separate, required statement from the object-write permission.

Amazon RDS Database Activity Streams captures database activity at the engine level, including every SQL statement, authenticated user, client IP, session ID, and execution timestamp, and pushes it as a near-real-time stream to Amazon Kinesis. From Kinesis, the stream can be consumed by external audit, security, or monitoring tools to alert on suspicious queries or maintain an audit trail. This is exactly the capability needed to monitor database queries in real time, making it the correct answer.

AWS WAF is a web application firewall that protects web applications by inspecting HTTP(S) requests and allowing or blocking them based on rules you define. It specifically includes managed rule groups and match conditions for SQL injection and cross-site scripting (XSS), as well as rate-based rules to mitigate abusive traffic. Since the application is running in EC2 behind an Application Load Balancer or Amazon CloudFront, AWS WAF can be attached to those endpoints directly.

Amazon RDS database logs, specifically the error log, are the authoritative source for database-level authentication failure entries. For example, MySQL error logs record messages like 'Access denied for user 'alice'@'host' (using password: YES)' for each failed login, and PostgreSQL logs similarly capture 'FATAL: password authentication failed for user 'alice''. These logs are generated by the database engine itself and are accessible through the RDS console, the DescribeDBLogFiles API, or by streaming them to Amazon CloudWatch Logs. Because the question is about database authentication attempts, the RDS error log directly contains the required evidence.

CloudTrail organization trails are created in the management account and automatically apply to every account in AWS Organizations, delivering all account logs to a single S3 bucket without per-account configuration. This is the native mechanism for centralizing management-event logging across an organization, and the management account owns and controls the trail. Because the trail is organization-wide, you get consistent logging coverage and centralized governance.

Create a GuardDuty suppression rule that filters findings based on the NLB's public IP address and port, which automatically excludes those matching findings from the Active findings view and from CloudWatch Events delivery. Suppression rules evaluate regex-based criteria on finding fields, so you can scope the rule to exactly this endpoint while all other GuardDuty detections remain fully active and visible. This is GuardDuty's intended mechanism for whitelisting known false positives and involves no infrastructure changes, additional cost, or loss of detection coverage.

Network ACLs (NACLs) are stateless, subnet-level firewalls that evaluate rules in ascending numeric order and support both allow and deny rules. To automatically block a specific IP, you can add a deny rule with a /32 source CIDR at the top of the NACL, but because NACLs are stateless you must also write a corresponding rule for the return traffic. This explicit-denying capability makes NACLs one of the correct answers.

EventBridge is GuardDuty's native event bus integration. GuardDuty automatically publishes each finding as an event to the default event bus, where a rule can match the detail-type 'GuardDuty Finding' and use Lambda as a target. The rule supports filtering by severity, account, or finding type, and Lambda receives the finding JSON directly, enabling precise, low-latency automated remediation. This is the architecturally supported pattern with built-in retry and optional dead-letter queues.

Because the only Allow statement in the attached group policy is conditioned on both a permitted source IP range and HTTPS (SecureTransport=true), a request coming from an IP outside that range does not satisfy the source IP condition. In IAM evaluation, an Allow with unsatisfied conditions contributes no effective permission, and since no other applicable statement grants the action, the default-deny rule applies. The user is therefore denied even though HTTPS might be used.

An SCP applied at the root or OU level with a Deny effect for ec2:RunInstances and a StringNotLike/StringNotEquals condition on ec2:InstanceType explicitly blocks noncompliant launches for all principals inside the affected accounts, including IAM users, roles, and the root user. SCPs provide an authoritative guardrail because they are evaluated as a filter on the account's effective permissions and cannot be overridden by a more permissive IAM policy within that account. This gives central governance across the entire AWS Organization, making it the correct preventive control.

CloudTrail records API activity, CloudWatch Logs stores those events, and EventBridge filters them in near real time to trigger alerts. This satisfies the requirement to detect suspicious API calls as they occur, rather than relying on periodic batch analysis or delayed log review.

Creating a snapshot while the volume is attached is the correct approach because Amazon EBS snapshots are designed to be taken of in-use volumes without stopping the instance. The snapshot is crash-consistent (or file-system-consistent if the instance has the AWS backup agent or you freeze the filesystem), and it provides a point-in-time forensic copy that can later be analyzed by creating a new volume from the snapshot. This satisfies the incident response requirement to preserve evidence while keeping the instance running for continued investigation or memory acquisition.

An IAM user password is the primary authentication factor for the AWS Management Console, entered together with the account ID or alias at the sign-in page. This password is stored as a login profile for the IAM user and can be rotated manually by the user or administratively by an account administrator. It functions as a persistent credential that grants full access to the console session. This is one of the two standard ways to authenticate an IAM user.

CloudWatch Events rules that target an SNS topic must assume an IAM role that grants sns:Publish on that topic's ARN. Without that permission, the rule fails at execution time with an AccessDenied error, even though the event pattern matched and the rule appears to have fired. The correct fix is to verify the role's trust policy allows events.amazonaws.com to assume it and that the attached policy includes the exact sns:Publish action for the target topic.

The CreateAccessKey event is logged by CloudTrail when an IAM user or role calls the CreateAccessKey API to generate a new access key pair. This is precisely the event that indicates creation of a new access key, making it the correct answer. Note that while CloudTrail records the access key ID in the event, the secret access key is not logged; it is displayed only once at creation time. This event is also useful for detecting unauthorized credential creation.

A customer managed key provides the administrative control needed to satisfy the requirement, and KMS supports automatic rotation with a configurable period between 90 and 2560 days for symmetric keys generated in KMS. By creating a customer managed key with KMS-generated key material and setting its automatic rotation period to 365 days, the company achieves seamless annual rotation while decrypting data with previous key versions as needed.

GuardDuty uses DNS logs for domain-based threat detection.

Using HTTPS (TLS) endpoints for S3 requests encrypts the entire request payload, the headers, and the response in transit between the client and S3. TLS provides confidentiality, integrity, and authentication, preventing eavesdropping and tampering. This is the correct approach because it ensures each object upload is protected end-to-end at the application layer, regardless of network path.

A public subnet is defined by having a route table entry with a destination of 0.0.0.0/0 pointing to an Internet Gateway (IGW). This default route enables resources with public IPs to directly send and receive traffic from the internet. While the IGW is the actual gateway, the route in the public subnet is the configuration that makes the subnet public. Therefore, public subnets with routes to the IGW are a critical part of the architecture for internet-facing components.

This SCP denies iam:CreateUser when the aws:MultiFactorAuthPresent condition key evaluates to false, effectively allowing the action only for callers who authenticated with MFA. Because SCPs apply to all principals in an AWS organization, this check is enforced regardless of the permissions granted by an individual IAM policy. The Deny statement with a Bool condition is the precise, organizational-level mechanism that prevents creation of users without an MFA requirement.

Amazon EventBridge (formerly CloudTrail Events integration within CloudWatch Events) is the appropriate real-time service because it can consume CloudTrail API-call events and pattern-match on fields like eventName, userIdentity, errorCode, and sourceIPAddress. You can create a rule with a custom event pattern—for example, source: 'aws.cloudtrail' and eventName: 'DeleteBucket'—and route matching events to SNS, Lambda, or CloudWatch Logs to trigger alerts. This gives near-instant, event-driven detection of unauthorized API attempts, including filtered access-denied events.

Automating a Lambda-based containment action via EventBridge when a GuardDuty finding is detected is the correct initial response because it lets you immediately revoke all inbound and outbound security group rules on the affected instance. This stops lateral movement and malicious traffic while leaving the instance running and its memory and disk state intact for later forensic collection. The Lambda function must have the appropriate IAM policy to describe and modify security groups, and it can also log the rule changes to CloudTrail for audit.

Enforcing least privilege means granting only the specific API actions and resources required for the application's function, and then further constraining them with conditions such as ec2:ResourceTag or aws:SourceIp. This limits the blast radius if the instance is compromised because a breached application can only perform the minimal set of operations. A role's policy is the sole authority for what temporary credentials obtained through the instance profile can do, so its precision directly determines the security posture.

Amazon EventBridge can match CloudTrail API events in near real-time using event patterns and then invoke an AWS Lambda function as a target. The Lambda function can call iam:UpdateAccessKey with Status=Inactive to revoke the compromised key(s), and it can also publish a message to an SNS topic to alert security personnel. This serverless pattern is a recommended, native AWS approach for automated incident response to suspicious IAM activity, making it the correct choice here.

A CloudWatch metric filter can inspect CloudTrail events as they are streamed to a CloudWatch Logs log group and match the eventName field for StopLogging or DeleteTrail API calls. When the filter's metric value changes, a CloudWatch alarm triggers immediately, enabling a real-time response before the trail is completely stopped or deleted. This approach directly monitors the management events that disable auditing, without relying on secondary indicators like object delivery. It also supports optional SNS notifications and Lambda actions for automated remediation.

CloudTrail is the correct answer because it records API activity across AWS accounts, capturing details like source IP address, user agent, request parameters, and response elements. This enables security engineers to investigate potential security incidents by correlating who made the call, from what IP, and with what tool. CloudTrail events provide the forensic evidence needed to trace actions.

Gateway Load Balancer sits inline at Layers 3 and 4 by encapsulating traffic in GENEVE tunnels, forwarding packets to a fleet of firewall appliances while preserving flow symmetry. A Gateway Load Balancer endpoint is created in each subnet and becomes the next-hop target in VPC route tables, so all traffic entering or leaving those subnets is transparently steered through the firewall fleet. This design also provides health checks and autoscaling for the security appliances.

AWS Config conformance packs are collections of AWS Config rules and remediation actions that can be deployed across multiple accounts and Regions using CloudFormation StackSets. This provides a centralized, repeatable way to enforce and monitor compliance baselines without needing to log into each account individually. The StackSet orchestrates the deployment, while the conformance pack defines the rules that evaluate resource compliance.

This approach centralizes secret storage, enables automatic rotation, and uses caching to reduce API calls and latency. The Lambda function retrieves the secret at runtime; caching ensures that frequent invocations do not overwhelm Secrets Manager and that rotated credentials are picked up after cache expiry. This minimizes operational overhead and improves security.

AWS CloudTrail with CloudWatch Events is the correct choice because CloudTrail records all AWS API calls as events, and CloudWatch Events (now Amazon EventBridge) can evaluate those events in near real time using an event pattern that matches specific actions like S3 DeleteBucket. When the pattern matches, it immediately triggers an SNS topic to send notifications. This architecture gives you direct, low-latency alerting on API activity, which is exactly what the security engineer needs. Unlike the other options, it is purpose-built for reacting to individual API calls as they happen.

IAM Access Advisor reports the last-accessed timestamp for each service the developer actually used. Building a custom policy from that historical usage removes unused permissions, achieving least privilege without breaking required workflows, unlike blanket administrator access.

Referencing the ALB's security group ID as the source makes the EC2 rule follow the load balancer automatically, so only traffic from that ALB is permitted. This is more precise than CIDR ranges, which would also admit any host in the ALB's subnets.

Amazon CloudWatch publishes VPN tunnel metrics natively, including TunnelState (UP/DOWN) and DataTransferred. A sudden, unexplained tunnel flap, prolonged DOWN state, or throughput spike during an idle period can signal a renegotiation attack, a man-in-the-middle redirecting traffic to an unauthorized peer, or a compromised customer gateway. Because these metrics are captured from the AWS side of the IPsec tunnel and are continuously recorded, they can be compared against historical baselines to detect abnormal behavior that would indicate interception or tampering.

GuardDuty continuously monitors CloudTrail management events, VPC Flow Logs, and DNS logs to detect threats. It can identify anomalous behavior such as an IAM access key being used from an unusual geographic location. GuardDuty generates findings that can trigger alerts via CloudWatch Events or SNS, meeting the requirement.

GuardDuty is natively integrated with AWS Organizations, and the recommended practice is to enable it in the management account, then designate a delegated administrator account to centrally manage GuardDuty for all member accounts. The delegated administrator can configure detectors, manage findings, and send automated responses, while the management account retains full governance control. This approach automatically covers all existing and future accounts in the organization without requiring per-account manual steps, and it also enables centralized aggregation of findings.

AWS Organizations delegated administrator is a native feature that lets you designate a member account as the administrative owner for a specified AWS service across the entire organization. For example, a finance account can be registered to manage Cost Explorer and billing reports for all accounts, so finance staff can perform service-specific administrative tasks without needing the management account's root user. This provides centralized, org-wide service administration while preserving the principle of least privilege.

VPC Traffic Mirroring copies live traffic from a source ENI and sends it to a designated monitoring appliance or security tool, enabling full packet capture and deep packet inspection. Because it operates at the hypervisor level, it can see every packet, including payloads, without installing agents on the instance. This allows the security engineer to analyze the exact malicious traffic and is the correct method for capturing full network data from the EC2 instance.

An IAM condition using aws:SourceIp restricts valid S3 requests to a specified CIDR range, ensuring credentials are only usable from your corporate or trusted network and shrinking the attack surface. This complements least-privilege actions by adding a network-layer control, but remember that if the request goes through a VPC endpoint, aws:SourceIp is not evaluated and you must use aws:sourceVpce instead. It is a valid, cost-free way to reduce exposure.

AWS CloudTrail is the authoritative audit service because it logs every supported AWS API call (management events, and optionally data events) with the caller's IAM identity, source IP address, user agent, request parameters, and response elements. A CloudTrail event history can be delivered to an S3 bucket and subsequently ingested into CloudWatch Logs or Amazon Security Lake, making it the primary evidence source for reconstructing who did what during a breach. It is the correct service to use when investigating suspicious API activity.

This is the correct and most restrictive inbound rule for a public HTTPS endpoint because HTTPS is implemented with TLS over TCP and defaults to destination port 443. Allowing TCP 443 from 0.0.0.0/0 enables any internet client to initiate a TCP connection and perform a TLS handshake with the web server. Because NACLs are stateless, you must also configure a separate outbound rule allowing the ephemeral port range (1024–65535) so the server's return traffic can reach that client. Restricting the inbound rule to TCP 443 avoids exposing other ports while still meeting the functional requirement.

CloudTrail with log file validation ensures log integrity. S3 Object Lock in compliance mode prevents deletion or modification for the retention period, providing immutability for one year. An EventBridge rule that triggers on DeleteObject or PutObject events for the bucket will alert on any attempt to delete or modify the logs, meeting all requirements.

CloudTrail log file integrity validation is the correct choice because it provides cryptographic verification of the log files: every log file's SHA-256 hash is included in a separate, frequently issued digest file that is signed with a private key. This hash chain lets you detect whether a log file was modified, deleted, or replaced after CloudTrail delivered it, and you can verify digests using the public key that CloudTrail publishes. Because an attacker would need the private key to forge a valid digest, this feature directly satisfies the requirement to determine whether CloudTrail logs have been tampered with.

AWS Systems Manager Run Command lets authorized responders execute scripts or commands on EC2 instances through the SSM Agent, eliminating the need for SSH bastion hosts or key management during an incident. This supports live response actions such as collecting volatile data, stopping services, or isolating a compromised instance, all while recording the execution in CloudTrail and allowing IAM-based permission controls.

Enable automatic rotation on the KMS key. AWS KMS automatically rotates the backing key material one year after the key is created and then every year thereafter, while keeping the same key ID and metadata, so Redshift continues to use the key without any reconfiguration. The old key material is retained to decrypt existing ciphertext, ensuring that all data encrypted under prior versions remains accessible. This meets the requirement of key rotation with minimal effort and no application changes.

AWS Shield Advanced provides cost protection to help offset charges incurred when protected resources automatically scale in response to a DDoS attack. For example, if a DDoS attack causes an Application Load Balancer to scale out or CloudFront to serve more requests, AWS can issue billing credits for those additional resource usage charges, as long as the resources are protected by Shield Advanced and the attack is detected. This ensures customers are not financially penalized for the very elasticity that keeps their applications resilient during an attack.

AWS Key Management Service (AWS KMS) is a fully managed service that centralizes the creation, storage, rotation, and deletion of customer master keys (CMKs). S3 integrates with KMS through server-side encryption (SSE-KMS), where S3 uses a KMS key to encrypt each object's data key automatically and enforces IAM policies on key usage. This gives you centralized control, auditability through CloudTrail, and seamless S3 encryption, making KMS the correct and standard service for encrypting data at rest in S3.

AWS IAM Identity Center (formerly AWS SSO) is the service designed to centrally manage workforce identities and fine-grained access to multiple AWS accounts and business applications. It connects to your existing identity provider via SAML 2.0 or SCIM, and its permission sets define which IAM roles users or groups assume in each account. This unified access model is exactly what a central management solution requires, so this is the correct choice.

Investigating the source IP address and user agent of the AssumeRole calls is the correct first step because those fields are directly logged in the CloudTrail management event and let the engineer determine whether the role was assumed from an expected corporate network and application versus an unknown external host. This information can be cross-referenced with VPC Flow Logs, AWS WAF logs, or threat intelligence to establish a baseline of legitimate usage and scope the incident. It preserves all evidence while enabling a quick threat verdict.

A customer managed KMS key provides the key material and granular key policy control required for SSE-KMS encryption of the sensitive objects. Without it, the bucket policy condition on aws:kms cannot be satisfied, since no suitable key exists to reference.

CloudTrail delivers all log records, including the enabled S3 data events, to the S3 bucket you specify when creating the trail. This bucket is the required durable destination for log file storage, and without it, event history is limited to 90 days and cannot be exported or integrated with other analytics tools.

Exporting log data from CloudWatch Logs to S3 via the CreateExportTask API is the native, recommended path for long-term archival. Once in S3, a lifecycle rule can transition objects from S3 Standard to S3 Glacier Deep Archive after 90 days, minimizing storage costs for data that is rarely, if ever, accessed while meeting the 7-year compliance requirement. This approach also lets you set a short retention on the original log group to avoid ongoing CloudWatch Logs storage fees after export completes.

SCPs in AWS Organizations set the maximum available permissions for every principal in a member account, including the root user, so a deny for cloudtrail:StopLogging, DeleteTrail and UpdateTrail blocks all users in the production account regardless of their IAM policies.

VPC Traffic Mirroring copies the full packet content from one or more elastic network interfaces (ENIs) of an EC2 instance and forwards it to a target such as a security appliance, an NLB, or an ENI that hosts a packet capture tool. This gives investigators the raw traffic needed to detect and analyze anomalies, lateral movement, or exfiltration without affecting the workload's primary network path. It is the correct choice when the goal is to capture and inspect actual network packets for a suspected compromise.

Amazon GuardDuty is a machine-learning and anomaly-detection security service that continuously analyzes AWS CloudTrail management and data events, VPC Flow Logs, and DNS query logs to identify unauthorized behavior, crypto-mining, credential compromise, and API abuse. It generates severity-ranked findings using threat intelligence and behavioral modeling, making it the core service for a threat detection solution.

The unified CloudWatch agent collects operating-system logs such as /var/log/secure or auth.log from EC2 instances and ships them to CloudWatch Logs, where metric filters and alarms can detect and alert on failed SSH login attempts.

A successful root ConsoleLogin without MFA leaves the account's most privileged identity protected by a password alone. Enabling MFA for the root user adds a second authentication factor, satisfying the requirement to strengthen security after confirming root console access.

Amazon GuardDuty is a continuous threat detection service that uses machine learning and threat intelligence to analyze AWS API activity from CloudTrail, VPC Flow Logs, and DNS logs. It specifically identifies anomalous IAM user behavior, such as a user's access key being used from a geographically distant location or at impossible travel speeds, which strongly suggests the key has been stolen. GuardDuty then generates a security finding that can be routed to a response playbook, making it the correct service for detecting this type of credential misuse.

This is the correct architecture because Security Hub ingests GuardDuty findings as security findings and can forward them to an EventBridge bus. An EventBridge rule can filter for specific finding types or severities and trigger a Lambda function, which then uses the AWS SDK to modify the security group. This decouples detection from remediation and is a standard, supported pattern for automated response to security findings.

Enabling MFA for each IAM user is the foundational prerequisite because AWS IAM does not automatically assign MFA devices. An administrator must manually activate a virtual or hardware MFA device for every user, and without this step no conditional policy can ever evaluate successfully because the MFA condition would always be false. This direct action ensures the compliance goal is met at the source, not just enforced at login.

The policy contains separate Action and Resource elements, and IAM permits an action only when an explicit Allow statement matches that action. Because ec2:TerminateInstances appears nowhere in the first statement's Action list (which grants Start and Stop) or in the second statement's Describe-only list, the action is implicitly denied by IAM's default-deny evaluation. Without an explicit Allow, no other statement or wildcard can rescue it; the request fails with an UnauthorizedOperation error.

Correct. Each account's trail sends logs to the central S3 bucket in the security account. The bucket policy allows cross-account writes, and the KMS key policy grants necessary permissions for CloudTrail and S3 from all accounts.

Enabling S3 Block Public Access adds a strong, explicit layer of protection that can block public reading or writing through bucket policies, ACLs, or object ACLs, even if those public grants are unintentionally set. This control operates at both bucket and account levels and is a primary safeguard against data exposure caused by misconfigurations, making it essential for sensitive data.

AWS Security Hub is the correct answer because it functions as a centralized cloud security posture management service that aggregates findings from multiple AWS detective and vulnerability services, including GuardDuty, Inspector, and Macie, into a single console. It enables detection by collecting these findings and facilitates response through event-driven automation using Amazon EventBridge, custom actions, and integration with SIEM or ticketing tools. While it does not generate its own raw detections, it provides the unified visibility and orchestration needed to both detect and respond to security issues across an entire AWS environment.

Security groups are stateful and are attached to elastic network interfaces (ENIs), automatically permitting return traffic without requiring separate outbound rules for responses. They can be applied consistently across all instances within a subnet to provide effective subnet-wide filtering with connection tracking, which aligns with the security team's need for granular, connection-aware traffic control. Because they operate per-interface and maintain state, they are the correct choice in this scenario.

IAM roles with specific permission policies and trust policies enable cross-account access by allowing principals from a trusted account to assume the role and receive temporary, scoped AWS credentials through the AWS STS AssumeRole API. The role's trust policy specifies which accounts or principals may assume it, while the permission policy limits what those principals can do after assuming it, providing a true least-privilege mechanism. This is the correct approach because it avoids long-lived credentials, enforces the principle of least privilege, and supports conditions such as MFA, source IP, or session tags for further restriction.

StackSets with service-managed permissions automatically deploy the CloudTrail trail to every account, including newly created ones, satisfying the automatic-enablement constraint with minimal overhead. The SCP complements this by preventing trail deletion or bucket-policy tampering, enforcing immutability across the organisation without per-account scripting.

Using AWS Organizations, you can create an organization trail from the management account that automatically logs CloudTrail management events for every account in the organization, including future accounts, with no per-account configuration. The trail delivers log files to a single designated S3 bucket in the management account, enabling centralized collection and analysis through Athena, QuickSight, or other tools. This is the native, designed method for centralizing CloudTrail logs across multiple accounts.

This design works because CloudTrail delivers compressed log files as S3 objects, and S3 Event Notifications invoke Lambda for each new object. Lambda then unpacks the gzipped CloudTrail JSON, filters for key API activity, and writes normalized events to CloudWatch Logs or fires alerts, giving near-real-time analysis without managing servers or a streaming buffer. It is serverless, cost-effective, and tightly integrated with S3, making it the natural choice for a central log collection and analysis pipeline.

This is correct because launching a cross-account encrypted AMI requires three separate sharing actions: the AMI itself via ModifyImageAttribute, each backing snapshot via ModifySnapshotAttribute, and the KMS key via a key policy update that grants the target account decrypt permissions. The target account's IAM roles or users must be able to call kms:Decrypt (and kms:CreateGrant for the launch to create a grant) on the source CMK. After these steps, the target can launch the instance and optionally re-encrypt the resulting volumes with its own KMS key. This layered authorization is the standard, supported pattern for sharing encrypted AMIs across accounts.

To encrypt a CloudWatch Logs log group with a customer-managed CMK, you must use the AssociateKmsKey operation (or the console's encryption settings) and pass the key ARN for the log group. Once associated, CloudWatch Logs uses that CMK to encrypt all log data written to the log group. This is the action that actually fulfills the requirement; no other configuration changes the encryption of the log group's stored data.

Changing the data resource value to 'arn:aws:s3:::my-bucket/' correctly covers all objects within the bucket. In CloudTrail's DataResource configuration for S3, the ARN must specify a prefix; a trailing slash after the bucket name represents the root prefix, meaning all objects inside that bucket. Without the slash, CloudTrail does not match object-level operations. This is the standard pattern for logging all S3 data events for a single bucket.