DEA-C01 Practice Question 20: CloudTrail S3 Data Events
AWS Certified Data Engineer – Associate (DEA-C01) · Test 2 · question 10 of 10
Auditors have asked a data engineering team to show which IAM principals read objects from the s3://finance-restricted/ bucket. An engineer opened CloudTrail Event history and found bucket configuration changes such as PutBucketPolicy, but no GetObject calls at all, even though the bucket is read daily. Going forward, the team must keep a durable, queryable record of every read of objects in this bucket, including who made each request. It wants to avoid paying to log object activity for the company's other buckets.
What should the data engineer do?
Show answer and explanation
Answer:
CloudTrail separates management events (control-plane calls like PutBucketPolicy) from data events (data-plane calls on or in a resource). S3 object-level calls such as GetObject are data events, and "by default, CloudTrail doesn't log data events. The CloudTrail Event history doesn't record data events." That explains what the engineer saw: bucket-level changes appear, and reads never do. To capture reads, configure a trail to log S3 data events. Advanced event selectors can filter on resources.ARN, eventName, and readOnly, so logging can be limited to reads of this one bucket, which avoids data event charges for the other buckets. Each record includes the calling identity. The logs land in S3, where they are durable and can be queried with Athena.
Option A can't work. Event history never contains data events, however long it keeps events. It is also a fixed 90-day view of management events, not a retention setting you can extend.
Option B confuses classification with auditing. Macie finds sensitive data and reports on bucket security posture. It does not produce a record of each principal that read each object.
Option C records *configuration state*. Config tracks changes to settings like the bucket policy, encryption, and versioning over time. Reading an object doesn't change the bucket's configuration, so no configuration item is recorded.
(CloudTrail Lake event data stores can also collect data events. However, AWS closed CloudTrail Lake to new customers on May 31, 2026, so a trail delivering to S3 is the approach any account can use.)
References: Amazon S3 CloudTrail events; Logging data events