As an AWS system administrator, you need to create a new trail that should log both management events and data events in AWS CloudTrail. And the trail logs should be delivered to the log streams of a new CloudWatch Log group. To configure that, an IAM role is required for AWS CloudTrail to assume. Which of the following IAM permissions should the IAM role have? (Select TWO.)

Answer options:

A.logs:CreateLogStream
B.logs:*
C.logs:PutLogEvents
D.S3:*
E.CloudWatch:ForwardLogEvents

Correct Answers: A and C
Options A and C are CORRECT because when users enable CloudWatch Logs in a new trail, they need to configure an IAM role with suitable permissions:
With this role, CloudTrail will be able to create CloudWatch Log streams of the new Log Group first and then put events into the log streams.
“logs:CreateLogStream” is required to create new log streams for the Log Group. “logs:PutLogEvents” is required for delivering CloudTrail events to the log streams in CloudWatch.
Option B is incorrect because “logs:*” means all CloudWatch Log permissions, which is not needed in this scenario.
Option D is incorrect because delivering events to CloudWatch logs does not need S3 permissions.
Option E is incorrect because the permission “CloudWatch:ForwardLogEvents” is invalid. The correct CloudWatch Log permission should be “logs:PutLogEvents”.
Reference:
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-required-policy-for-cloudwatch-logs.html