An administrator would like to check if the Amazon CloudFront identity is making access API calls to an S3 bucket where a static website is hosted. Where can this information be obtained?

Answer options:

A.Configuring Amazon Athena to run queries on the Amazon CloudFront distribution.
B.Check AWS CloudWatch logs on the S3 bucket.
C.In the webserver, tail for identity access logs from the Amazon CloudFront identity.
D.In AWS CloudTrail Event history, look up access calls and filter for the Amazon CloudFront identity.

Correct Answer – D
By viewing Event history in Amazon CloudTrail, the administrator can be able to access operational, access and activity logs for the past 90 days, to the S3 bucket that hosts the static website.
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events-console.html
Option A is INCORRECT because Amazon Athena will need a specific data repository from which a database and table can be created in order to run queries. Data repositories can be a folder in an S3 bucket where logs are written to.
Option B is INCORRECT because AWS CloudWatch does not log access API calls from one resource to another. AWS CloudTrail can do this.
Option C is INCORRECT because it is not possible to access the underlying web server for CloudFront. It is fully managed by AWS.