CloudTrail for API auditing in AWS - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create a CloudTrail trail that logs API activity.

AWS

resource "aws_cloudtrail" "example" {
  name                          = "example-trail"
  s3_bucket_name                = [1]
  include_global_service_events = true
}

Drag options to blanks, or click blank then click option'

Amy-logs-bucket

Bexample-bucket

Capi-audit-bucket

Dcloudtrail-logs

Attempts:

3 left

💡 Hint

Common Mistakes

Using a bucket name that does not exist or is not configured for CloudTrail logs.

The s3_bucket_name must be the name of an existing S3 bucket where CloudTrail stores logs. Here, cloudtrail-logs is the correct bucket name.

2fill in blank

medium

Complete the code to enable logging of management events in CloudTrail.

AWS

resource "aws_cloudtrail" "example" {
  name                          = "example-trail"
  s3_bucket_name                = "cloudtrail-logs"
  include_global_service_events = true
  [1] {
    read_write_type = "All"
  }
}

Drag options to blanks, or click blank then click option'

Amanagement_event_selector

Bmanagement_events

Cevent_selector

Devent_logging

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect block names like management_event_selector which do not exist.

The event_selector block is used to specify which events CloudTrail should log, including management events.

3fill in blank

hard

Fix the error in the CloudTrail resource to properly enable multi-region logging.

AWS

resource "aws_cloudtrail" "example" {
  name                          = "example-trail"
  s3_bucket_name                = "cloudtrail-logs"
  is_multi_region_trail         = [1]
  include_global_service_events = true
}

Drag options to blanks, or click blank then click option'

A"false"

Btrue

C"true"

Dfalse

Attempts:

3 left

💡 Hint

Common Mistakes

Using quoted strings for boolean values causes errors.

The is_multi_region_trail attribute expects a boolean value, not a string. So true without quotes is correct.

4fill in blank

hard

Fill both blanks to configure CloudTrail to log only write management events and exclude read events.

AWS

resource "aws_cloudtrail" "example" {
  name           = "example-trail"
  s3_bucket_name = "cloudtrail-logs"
  event_selector {
    read_write_type = [1]
    include_management_events = [2]
  }
}

Drag options to blanks, or click blank then click option'

A"WriteOnly"

Btrue

Cfalse

D"All"

Attempts:

3 left

💡 Hint

Common Mistakes

Setting include_management_events to false disables management event logging.

Setting read_write_type to "WriteOnly" logs only write events. include_management_events must be true to include management events.

5fill in blank

hard

Fill all three blanks to create a CloudTrail trail with encryption enabled and SNS notifications for log file delivery.

AWS

resource "aws_cloudtrail" "example" {
  name                          = "example-trail"
  s3_bucket_name                = "cloudtrail-logs"
  enable_log_file_validation    = [1]
  kms_key_id                   = [2]
  sns_topic_name               = [3]
}

Drag options to blanks, or click blank then click option'

Atrue

B"arn:aws:kms:us-east-1:123456789012:key/abcd-1234-efgh-5678"

C"cloudtrail-notifications"

Dfalse

Attempts:

3 left

💡 Hint

Common Mistakes

Using false for enable_log_file_validation disables validation.

Providing incorrect formats for KMS key or SNS topic.

Enable log file validation with true. Provide the KMS key ARN for encryption. Set the SNS topic name for notifications.