Exam AWS Certified Solutions Architect - Professional topic 1 question 830 discussion

AWS CloudTrail provides comprehensive logging of API calls, including S3 data events, which includes object-level operations like GetObject, PutObject, etc. Data event logging for S3 ensures that every read and write operation at the object level is captured, which satisfies the requirement to log any event that retrieves data from S3 buckets. Enabling data event logging for both current and future S3 buckets ensures compliance with the new security policy and makes sure that no events are missed. Using the audit logs S3 bucket to store the logs consolidates all audit logs in a centralized, designated account, enhancing security and manageability. Enabling server access logging (Option A) only provides information about requests to S3 buckets, but does not capture the detailed object-level events required by the security policy. Hence, CloudTrail is the more suitable solution for the specified requirements.

I'll go with D

D - Is the standard configuration when we deploy environments. https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-cloudtrail-logging-for-s3.html

Infact , access logs does not support cross accout log delivery: https://docs.aws.amazon.com/AmazonS3/latest/userguide/logging-with-S3.html

only D will force the policy on for future buckets

D is correct.