Enabling S3 Data Events in CloudTrail Across an Organization
A company has a CloudTrail trail that logs management events for all regions in the management account. They want to also log data events for all S3 buckets in the organization. Which configuration change will meet this requirement with the LEAST operational overhead?
Quick Answer
The correct answer is to modify the existing trail to add an event selector for S3 data events with a scope of all buckets. This works because a single organization trail in CloudTrail can centrally log data events for every S3 bucket across all accounts in the organization, eliminating the need to configure per-bucket selectors or create separate trails. On the AWS Certified Security Specialty SCS-C02 exam, this concept tests your understanding of enabling S3 data events in CloudTrail for all buckets organization-wide with minimal operational overhead, often appearing as a trap where candidates mistakenly think they need individual event selectors per bucket or separate trails per account. The key distinction is that CloudTrail’s event selector allows you to choose “All S3 buckets” in one scope, while options like creating new trails in each member account or using CloudWatch Events add unnecessary complexity. Memory tip: think “one trail, all buckets” — a single organization trail with a global data event selector covers every S3 bucket across your entire AWS organization.
⚠ Common exam trap
Candidates often think data events require separate trails or external services like EventBridge, but CloudTrail's built-in event selector for S3 data events with an 'all buckets' scope directly meets the requirement with minimal overhead.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the existing trail to add an event selector for S3 data events with a scope of all buckets.
CloudTrail trails can be configured with an event selector that includes data events for S3, and setting the scope to 'all buckets' logs data events for every S3 bucket in the account without needing separate configurations. This approach reuses the existing management trail, minimizing operational overhead by avoiding additional trails, services, or aggregation steps.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Amazon EventBridge to capture S3 events and forward them to CloudTrail.
Why it's wrong here
EventBridge is not used to feed events into CloudTrail; CloudTrail directly monitors S3 API calls.
- ✗
Enable S3 server access logs for all buckets and aggregate them using Athena.
Why it's wrong here
Server access logs are different from CloudTrail data events; they do not capture API calls.
- ✗
Create a new trail in each member account to log S3 data events and deliver to a central S3 bucket.
Why it's wrong here
This increases operational overhead and does not leverage organization trails.
- ✓
Modify the existing trail to add an event selector for S3 data events with a scope of all buckets.
Why this is correct
Organization trails can log data events for all S3 buckets across the organization with a single configuration.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 376 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a CloudTrail trail that logs management events for all regions. The security team notices that some S3 data events are not being logged. How should the team enable logging for all S3 data events?
hard- ✓ A.Update the existing CloudTrail trail to include data events for S3
- B.Create a new CloudTrail trail that logs only data events
- C.Use Amazon GuardDuty to monitor S3 access
- D.Enable S3 server access logging on each bucket
Why A: CloudTrail trails can be configured to log data events for S3 in addition to management events. By updating the existing trail to include S3 data events (e.g., GetObject, PutObject), the security team can capture all object-level API activity without creating a separate trail. This ensures comprehensive logging while maintaining the existing management event logging for all regions.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.