A construction firm has stored all its project documents in the Amazon S3 bucket with external vendors accessing this data on a need basis. The Security Team performs an audit for this access & is looking for cryptographic protocols used by vendors to access this data. Which of the following can help to collect this data?

Answer options:

A.Enable Server access logging & check the TLS version for all requests.
B.Enable Server access logging & check Cipher Suite for all requests.
C.Enable Server access logging & check Host Header for all requests.
D.Enable Server access logging & check Signature Version for all requests.

Correct Answer – A
 Amazon S3 Server Access Logs can be used to record the following fields.
· Bucket Owner
· Bucket
· Time
· Remote IP
· Requestor
· Request ID
· Operation
· Key
· Request-URI
· HTTP Status
· Error Code
· Bytes Sent
· Object Size
· Total Time
· Turn-Around Time
· Referer
· User-Agent
· Version Id
· Host Id
· Signature Version
· Cipher Suite
· Authentication Type
· Host Header
· TLS version
Option B is incorrect as Cipher Suite will provide details of SSL negotiated for HTTPS request to S3.
Option C is incorrect as the Host Header provides details of the endpoint used to connect Amazon S3.
Option D is incorrect as it provides details of the signature version used for connection.
For more information on the Amazon S3 Access Logging format, refer to the following URL-
https://docs.aws.amazon.com/AmazonS3/latest/dev/LogFormat.html