A company stores details about transactions in an Amazon S3 bucket. The company wants to log all writes to the S3 bucket into another S3 bucket that…

AWS CloudTrail is the native AWS service for logging API activity. S3 object-level operations, such as writes (PutObject), are classified as data events. Creating a CloudTrail trail configured to capture data events for the source S3 bucket is the most direct and efficient method. This approach allows for filtering to log only write events and delivering them to a destination S3 bucket. As a fully managed, configuration-based solution, it requires no custom code or complex integrations, thereby representing the least operational effort.

1. AWS CloudTrail User Guide

"Logging data events for trails": This document explicitly states

"Data events provide information about the resource operations performed on or in a resource. These are also known as data plane operations... For Amazon S3

you can log object-level API activity (for example

GetObject

DeleteObject

and PutObject API operations)." This confirms that PutObject (a write) is a data event.

2. AWS CloudTrail User Guide

"Creating a trail": The guide details the process of creating a trail and specifies that for S3 object-level activity

you must choose to log "Data events." It also shows the configuration options to select specific buckets

read/write events

and a log file delivery location (another S3 bucket)

confirming this is a direct

configuration-based solution.

3. Amazon S3 User Guide

"Logging Amazon S3 API calls by using AWS CloudTrail": This guide recommends CloudTrail for logging S3 API calls and distinguishes between management events and data events. It notes

"By default

CloudTrail trails don't log data events. To log S3 object-level actions

you must explicitly enable data events." This reinforces that a specific configuration for data events is the intended method.