CloudTrail Log Encryption and Long-Term Retention

A security team needs to ensure that all API calls made in the AWS account are logged and the logs are stored in a central S3 bucket that is encrypted with a KMS key. Which combination of steps should the team take to achieve this?

⚠ Common exam trap

The trap is confusing services that log activity (CloudTrail for API calls, Config for resource changes, VPC Flow Logs for network traffic) and selecting one that does not capture API calls.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable CloudTrail and configure it to deliver logs to an encrypted S3 bucket.

AWS CloudTrail records all API calls made in an AWS account, including management events and optionally data events, and can be configured to deliver log files to a central S3 bucket. By enabling CloudTrail with an S3 bucket destination and configuring the bucket with SSE-KMS encryption using a KMS key, the team meets both requirements: logging all API calls and storing logs encrypted with KMS. This is the standard AWS approach for API activity auditing.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Enable AWS Config and have it deliver configuration history to an encrypted S3 bucket.
Why it's wrong here
AWS Config is a service that records configuration state changes and resource relationships over time. While it can deliver configuration history to an encrypted S3 bucket, that data contains snapshots of resource settings, not a record of API calls made in the account. Therefore, it does not satisfy the requirement to log all API activity.
✗
Enable CloudWatch Logs and stream logs to an encrypted S3 bucket.
Why it's wrong here
Amazon CloudWatch Logs is designed to collect, monitor, and store log data from applications and AWS services, and it can stream those logs to an S3 bucket. However, CloudWatch Logs is not the service that natively captures API calls; API activity is recorded by AWS CloudTrail. Enabling CloudWatch Logs alone would miss the API call records required.
✗
Enable VPC Flow Logs and publish to an encrypted S3 bucket.
Why it's wrong here
VPC Flow Logs capture metadata about IP traffic flowing to and from network interfaces in a VPC, including source/destination IPs, ports, and protocol, but they do not log API actions or identity information. Publishing flow logs to an encrypted S3 bucket is a valid storage option, yet it would provide network-level data rather than an audit trail of API calls. This option fails to meet the security team's objective.
✓
Enable CloudTrail and configure it to deliver logs to an encrypted S3 bucket.
Why this is correct
AWS CloudTrail is the service explicitly designed to log every API call made in your AWS account, recording details like caller identity, source IP, request parameters, and response data. You can configure a trail to deliver these JSON log files to an S3 bucket, and enabling encryption on that bucket (e.g., with SSE-KMS or SSE-S3) protects the logs at rest. This satisfies the requirement to ensure all API calls are logged and stored securely.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

CloudTrail Log Encryption and Long-Term Retention

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question