CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Centralizing Logging for AWS Multi-Account Architecture
Learn how to choose the best logging solution for AWS multi-account architectures. We break down the question and options.
In the AWS Certified Security - Specialty exam, questions about centralized logging often trip candidates. Understanding the specific requirement for security auditing is crucial. Let's break down a relevant question to illustrate this.
The question
A company has multi-account architecture and wants to centralize logging for all AWS account activity. Which solution should the company use to ensure logs are protected and can be analyzed for security auditing?
- A. Use AWS CloudTrail to log API calls and store logs in an S3 bucket with server-side encryption.
- B. Enable VPC Flow Logs for all accounts and analyze logs with Amazon Athena.
- C. Set up AWS Config rules for compliance monitoring.
- D. Utilize AWS Shield for DDoS protection logs.
Think before you scroll
When considering the options, focus on the primary goal: centralizing logging for security auditing. Look for solutions that specifically address logging of account activities and protection measures for stored logs.
The answer
The correct option is A: Use AWS CloudTrail to log API calls and store logs in an S3 bucket with server-side encryption. This option directly addresses the requirement to log API activity across multiple accounts while ensuring the logs are protected and suitable for auditing purposes.
Why the other options lose
- B: Enable VPC Flow Logs for all accounts and analyze logs with Amazon Athena. While VPC Flow Logs are useful for monitoring network traffic, they do not provide API call logging, which is essential for security auditing. This option misses the mark on the main requirement.
- C: Set up AWS Config rules for compliance monitoring. AWS Config is focused on resource compliance and configuration management, not centralized logging of account activity. It does not fulfill the logging requirement for auditing.
- D: Utilize AWS Shield for DDoS protection logs. AWS Shield is a service designed to protect against DDoS attacks, not for logging AWS account activity. This option is not relevant to the question's focus on logging and auditing.
The concept behind it
Centralized logging is crucial for security auditing in multi-account environments. AWS CloudTrail provides a comprehensive solution by logging all API activity, while storing logs securely in S3 with server-side encryption. This ensures that logs are both protected and readily available for analysis.
Exam trap to remember
Remember: Centralized logging for security audits requires specific logging of API calls. Focus on solutions that provide this capability.