Incident and Event Response

A security team wants every change to an Amazon S3 bucket policy across the account to trigger an automated response. The team has confirmed that AWS CloudTrail management events are delivered to the default event bus. They need an Amazon EventBridge rule that runs only when a PutBucketPolicy API call occurs, and they want the matched event passed to an AWS Lambda function that evaluates the new policy. With the least custom code, how should the rule be built?

• ACreate an EventBridge rule with an event pattern that matches the aws.s3 event source and the PutBucketPolicy event name, then add the Lambda function as a target so the function receives the matched CloudTrail event directly.check_circle Correct
• BCreate an EventBridge rule with a schedule expression that fires every five minutes and targets a Lambda function that scans CloudTrail logs for any recent PutBucketPolicy call before evaluating the bucket policy.
• CConfigure an Amazon S3 event notification on each bucket for the s3:ObjectCreated event type and route it to the Lambda function, which then reads the current bucket policy and evaluates it.
• DCreate an EventBridge rule that matches all events from the aws.s3 source, then have the Lambda target inspect each event and discard anything that is not a PutBucketPolicy call before evaluating the policy.

Why A is correct: An event pattern keyed on the source and the specific eventName matches only the PutBucketPolicy call, and naming the function as a target delivers the matched event as the payload, so EventBridge does the filtering and invocation with no extra code.

Why B is wrong: A scheduled rule polling CloudTrail can find the call eventually, but it adds latency and log-scanning code, whereas the requirement is an event-driven match on the API call with the least custom logic.

Why C is wrong: S3 event notifications report object-level activity such as ObjectCreated, not bucket policy changes, so this never fires on PutBucketPolicy and fails to detect the management action in scope.

Why D is wrong: Matching every S3 event then filtering inside the function works but invokes Lambda needlessly on unrelated calls and pushes filtering into code, when an event pattern can match only PutBucketPolicy at the rule.