Possible Incorrect Question/Answer in AWS DevOps Professional Practice Exam

[Danny Gonzalez]

In exam: Review Mode Set 2 – AWS Certified DevOps Engineer Professional

Question 29: A company has confidential files containing patent information stored in an Amazon S3 bucket in the US East (Ohio) region. Among the team members working on the project, actions need to be monitored on the objects, such as PUT, GET, and DELETE operations. The goal is to search and review these actions for auditing purposes easily.

Which solution will meet this requirement MOST cost-effectively?

As per your concept, correct answer is: Create an AWS CloudTrail trail to track and store your S3 API call logs in an S3 bucket. Create an AWS Lambda function that logs data events of your S3 bucket. Trigger this Lambda function using the Amazon EventBridge rule for every action taken on your S3 objects. View the logs on the Amazon CloudWatch Logs group.

However taking into account AWS documentation, For S3 Event Notifications with EventBridge — You enable EventBridge on the S3 bucket itself (in bucket properties). Once enabled, S3 sends object-level events (Object Created, Object Deleted, etc.) directly to EventBridge without requiring CloudTrail. From there, an EventBridge rule can route events to a CloudWatch Logs log group as a target.

Reference: https://docs.aws.amazon.com/AmazonS3/latest/userguide/EventBridge.html