Your company has several Cloudtrail log files defined.
They now need to ensure that files have not been tampered with.
How can you ensure this requirement is fulfilled?
Click on the arrows to vote for the correct answer
A. B. C. D.Correct Answer: B.
The AWS Documentation mentions the following.
To determine whether a log file was modified, deleted, or unchanged after CloudTrail delivered it, you can use CloudTrail log file integrity validation.
This feature is built using industry-standard algorithms: SHA-256 for hashing and SHA-256 with RSA for digital signing.
This makes it computationally infeasible to modify, delete or forge CloudTrail log files without detection.
You can use the AWS CLI to validate the files in the location where CloudTrail delivered them.
Because it is clearly mentioned in the AWS Documentation how this can be achieved.
All other options are incorrect.
For more information on Cloudtrail log file integrity, please refer to the below URL-
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.htmlThe best answer for this scenario is B. Enable log file integrity for the log files.
CloudTrail is an AWS service that records API calls and events for your account. It provides a history of AWS API calls for an AWS account, including the identity of the caller, the time of the call, the source IP address, the request parameters, and the response elements returned by the AWS service. This data is crucial for security, compliance, operational analysis, and troubleshooting purposes.
To ensure the integrity of the CloudTrail logs, you can enable log file integrity validation, which is a feature that checks the integrity of the log files by verifying their digital signatures. The digital signature is a cryptographic mechanism that provides a way to verify the authenticity and integrity of a file.
When you enable log file integrity validation, CloudTrail adds a digital signature to each log file, using an AWS Key Management Service (KMS) customer master key (CMK) that you specify. CloudTrail uses the SHA-256 hash algorithm to generate the signature. The digital signature is appended to the end of the log file as a separate file, with the same name as the log file and the ".digest" extension.
To validate the integrity of the log file, you can use the AWS CLI or SDKs to calculate the digital signature of the log file, using the same KMS CMK that was used to generate the signature. Then, you compare the calculated signature with the signature stored in the ".digest" file. If the signatures match, the log file has not been tampered with.
Enabling log file integrity validation also prevents anyone from modifying the log files, because any modification would invalidate the digital signature. Furthermore, CloudTrail automatically encrypts the log files at rest using Amazon S3 server-side encryption (SSE) with Amazon S3-managed keys (SSE-S3) or KMS-managed keys (SSE-KMS), depending on your configuration.
Therefore, option B is the best choice to ensure that CloudTrail log files have not been tampered with. Option A is not sufficient because read access does not prevent tampering. Options C and D are not relevant because changing the IAM policy or bucket ACL does not provide integrity validation or encryption.