You currently operate a web application deployed in AWS. Your IT security compliance officer has tasked you to develop a reliable and durable logging solution to track API activities made to your global resources such as IAM. The solution must ensure the integrity and confidentiality of your log data. Which of these solutions would you recommend?

Answer options:

A.Create a new CloudTrail trail that applies to all AWS Regions. Use one new S3 bucket to store the logs. Use IAM roles S3 bucket policies and Multi-Factor Authentication (MFA) Delete on the S3 bucket that stores your logs. Enable log file integrity validation for CloudTrail.
B.Create a new CloudTrail with one new S3 bucket to store the logs. Configure SNS to send log file delivery notifications to your management system. Use IAM roles and S3 bucket policies on the S3 bucket that stores your logs.
C.Create a new CloudTrail trail with an existing S3 bucket to store the logs and with the global services option selected. Use S3 ACLs and Multi Factor Authentication (MFA) Delete on the S3 bucket that stores your logs.
D.Create three new CloudTrail trails with three new S3 buckets to store the logs, one for the AWS Management console, one for AWS SDKs, and one for command-line tools. Use IAM roles and S3 bucket policies on the S3 buckets that store your logs.

Answer – A
AWS Identity and Access Management (IAM) is integrated with AWS CloudTrail, a service that logs AWS events made by or on behalf of your AWS account. CloudTrail logs authenticated AWS API calls and AWS sign-in events and collect this event information in files delivered to Amazon S3 buckets.
To determine whether a log file was modified, deleted, or unchanged after CloudTrail delivered it, you can use CloudTrail log file integrity validation. This feature is built using industry standard algorithms: SHA-256 for hashing and SHA-256 with RSA for digital signing. This makes it computationally infeasible to modify, delete or forge CloudTrail log files without detection.
Option B is incorrect because log integrity validation should be enabled.
Option C is incorrect because you should use bucket policies.
Option D is incorrect because you should ideally create one S3 bucket, and there is no need to create three trails.
For more information on Cloudtrail, please visit the below URL:
http://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html