Proactive Alert for Amazon S3 API Actions | Corrective Actions | Security Head
Question
An Educational Institute is saving all its digital learning material in an Amazon S3 bucket.
During a routine security audit, it was observed that Amazon S3 API was invoked from the malicious IP address to access the learning material last month.
Security Head is looking for a proactive alert for such API actions to take corrective actions promptly. Which service can be used to view these security alerts?
Answers
Explanations
Click on the arrows to vote for the correct answer
A. B. C. D.Correct Answer: A.
Amazon GuardDuty can be used to monitor object-level API actions within Amazon S3 buckets.
This can identify any security risks for data saved in the Amazon S3 bucket.
Amazon GuardDuty uses AWS CloudTrail management events and CloudTrail S3 data events to analyze security risks.
Option B is incorrect as Amazon Macie can be used to detect sensitive data stored in the Amazon S3 bucket.
It is not a correct service to identify malicious IP addresses invoking Amazon S3 API.
Option C is incorrect as Amazon S3 inventory is for managing Amazon S3 storage.
Option D is incorrect as Amazon Server Access logs will record requests made to the Amazon S3 bucket.
It is not a correct service to identify malicious IP addresses invoking Amazon S3 API.
For more information on Amazon GuardDuty S3 protection, refer to the following URL,
https://docs.aws.amazon.com/guardduty/latest/ug/s3_detection.htmlThe correct answer for the question is (A) Review Amazon GuardDuty findings.
Explanation:
Amazon GuardDuty is a threat detection service that continuously monitors the AWS environment for suspicious activity and unauthorized behavior. It uses machine learning algorithms and analyzes various AWS service logs such as Amazon S3, CloudTrail, VPC Flow Logs, and DNS Logs to identify potential security threats.
In this scenario, the Security Head is looking for a proactive alert for API actions on the Amazon S3 bucket. Amazon GuardDuty is an ideal service for this purpose as it can detect and alert for API calls made from a malicious IP address. GuardDuty can detect the IP address that accessed the S3 bucket and trigger an alert based on predefined rules or custom rules. The alert can be sent to multiple destinations like SNS, CloudWatch Events, or Lambda function, enabling the Security Head to take corrective actions promptly.
Option (B) Review Amazon Macie alerts for this Amazon S3 bucket is incorrect as Macie is a data discovery and classification service, and it cannot detect malicious API actions. However, Macie can be used to classify sensitive data and monitor data access patterns to identify unusual behavior and data exfiltration attempts.
Option (C) Review Amazon S3 inventory files is incorrect as S3 inventory files provide a report of metadata about objects in the bucket, and they do not contain information about API access or security alerts.
Option (D) Review Amazon S3 Server Access logs is incorrect as S3 Server Access logs provide information about the requests made to the S3 bucket, but they do not provide any analysis or alerting for malicious activity. They can be used for audit purposes and troubleshooting issues related to access control and permissions.
