AWS Certified Developer - Associate Exam: Understanding Deletion of an S3 Bucket

Understanding Deletion of an S3 Bucket

Prev Question Next Question

Question

Your application is currently configured to interact with an S3 bucket.

Now you are getting errors that the bucket does not exist.

Which of the following is the best way to understand how the bucket was deleted?

Answers

Explanations

Click on the arrows to vote for the correct answer

A. B. C. D.

Answer - B.

You can use the Cloudtrail service to see when the bucket was deleted and who initiated the bucket deletion request.

Option A is incorrect since the logs will not have the detailed information about the bucket deletion request.

Option C is incorrect since this service is only used to check the vulnerabilities on servers.

Option D is incorrect since this service is only used to provide recommendations.

For more information on Cloudtrail logging, please refer to the below URL-

https://docs.aws.amazon.com/AmazonS3/latest/dev/cloudtrail-logging.html
Amazon $3 Bucket-Level Actions Tracked by CloudTrail Logging By default, CloudTrail logs bucket-level actions. Amazon S3 records are written together with other AWS service records in a log file. CloudTrail determines when to create and write to a new file based on a time period and file size. The tables in this section list the Amazon S3 bucket-level actions that are supported for logging by CloudTrail. ‘Amazon $3 Bucket-Level Actions Tracked by CloudTrail Logging REST API Name API Event Name Used in CloudTrail Log DELETE Bucket DeleteBucket DELETE Bucket cors DeleteBucketCors DELETE Bucket encryption _ DeleteBucketEncryption DELETE Bucket lifecycle DeleteBucketLifecycle DELETE Bucket policy DeleteBucketPolicy DELETE Bucket replication _ DeleteBucketReplication DELETE Bucket tagging DeleteBucketTagging DELETE Bucket website DeleteBucketWebsite

The best way to understand how the bucket was deleted is to use the CloudTrail logs. CloudTrail is a service that records API calls made within an AWS account. By default, it logs events for most AWS services, including S3.

Option A, using CloudWatch logs, would not be the best choice because CloudWatch is primarily used for monitoring and alerting purposes. While it is possible to enable S3 bucket access logging to send logs to CloudWatch, it would not provide information on whether the bucket was deleted.

Option C, using the AWS Inspector service, is a security assessment service that analyzes the behavior of applications running on EC2 instances. It is not relevant for investigating S3 bucket deletions.

Option D, using the AWS Trusted Advisor service, provides recommendations to optimize and secure AWS resources. While it may highlight issues related to S3 bucket configurations, it would not provide information on the deletion of the bucket.

Therefore, the correct option to choose is B, using CloudTrail logs to see the Bucket Deletion API request. By analyzing the CloudTrail logs, you can identify the user or role that made the API request to delete the bucket and investigate the cause of the deletion.

Prev Question Next Question