A review of a company's IaaS environment finds that audit logs for object storage access are written to a bucket in the same account, and the account's administrators can delete that bucket. Leadership worries that an attacker who gains administrator rights could erase the evidence of their own activity. Which design best addresses this concern?
Select an answer to reveal the explanation.
Short Explanation
Think of it like letting a suspect hold the only copy of the security camera footage. If the admin you're worried about can delete the logs, those logs prove nothing, so you ship them somewhere that admin can't reach and lock them as write-once. The trap is reaching for encryption or extra copies, which don't change who holds the delete button.
Full Explanation
Accountability of data events depends on logs surviving the compromise they are meant to record. The sound design forwards audit events to a separate logging account or tenant with its own administrators, grants the producing account write-only access, and applies immutable write-once-read-many retention so no one in the source account can alter or purge entries before the retention period ends. Logging deletions of log objects into the same bucket fails because the attacker can delete that record along with everything else; the evidence lives inside the blast radius. Encrypting the bucket with a customer-managed key protects confidentiality, not integrity or availability, and an administrator can still delete encrypted objects or the bucket itself. Replicating to a second bucket in the same account only doubles the work for an attacker who already holds account-wide administrator rights. Exam caveat: separation of duties applies to logs as well as to people; the log store should be governed by a different authority than the systems it watches. Operational check: confirm that no role in the workload account can delete or shorten retention on the central log store, and test by attempting a deletion with a workload administrator identity.