A company stores details about transactions in an Amazon S3 bucket. The company wants to log all writes to the S3 bucket into another S3 bucket that is in the same AWS Region. Which solution will meet this requirement with the LEAST operational effort?

AWS CloudTrail is the service designed to log API activity. S3 object-level operations, such as writes (e.g., PutObject), are classified as data events. Creating a CloudTrail trail to capture write-only data events for the specific S3 bucket is a direct, configuration-based solution. It requires no code and minimal setup, thus representing the least operational effort. The trail can be configured to deliver these logs to another S3 bucket as required.

A. This solution is overly complex, involving Lambda and Kinesis Data Firehose. It requires coding and managing multiple services, which is high operational effort compared to a direct CloudTrail configuration.
B. Management events in CloudTrail log account-level operations (e.g., CreateBucket), not object-level operations like writes. This option would not capture the required transaction details.
C. This option requires writing and maintaining an AWS Lambda function to process S3 event notifications. This is more operational effort than using the built-in CloudTrail data events feature.

1. AWS CloudTrail Documentation. (2023). Logging Amazon S3 API calls by using AWS CloudTrail. "You can configure your trail to log data events. Data events provide information about operations performed on or in a resource. These are also known as data plane operations. For example, you can record object-level API activity (for example, GetObject, DeleteObject, and PutObject API operations) for S3 buckets."

2. AWS CloudTrail User Guide. (2023). Data events. "Data events provide visibility into the resource operations performed on or in a resource. These are also known as data plane operations... Amazon S3 object-level API activity (for example, GetObject, DeleteObject, and PutObject API operations)".