CloudGuild · Blog · Cheat sheets · Lessons · Certifications
AWS Certified Security - Specialty (SCS-C02): Understanding API Call Monitoring
Learn how to effectively monitor API calls in AWS for compliance. We break down the exam question and clarify the best approach.
Choosing the right method to log API calls can confuse many candidates. Regulatory compliance demands accuracy and clarity in logging. Understanding the nuances of AWS services is crucial.
The question
An organization wants to ensure compliance with regulatory requirements by monitoring API calls in their AWS environment. They need to log these calls and retain the logs for a minimum of 12 months. What is the best approach to achieve this?
A. Enable AWS CloudTrail with an S3 bucket for log storage
B. Use Amazon CloudWatch Logs to monitor API calls directly
C. Use AWS Config to track AWS resource changes
D. Enable VPC Flow Logs for monitoring API traffic
Think before you scroll
Consider which AWS service is designed specifically for logging API calls. Think about the retention capabilities and regulatory compliance requirements. Not all options will meet these needs.
The answer
The correct option is A: Enable AWS CloudTrail with an S3 bucket for log storage. AWS CloudTrail is specifically built for logging API calls. It captures all API actions in your AWS account and can store logs in an S3 bucket, where retention policies can be easily managed to meet compliance requirements.
Why the other options lose
B: Use Amazon CloudWatch Logs to monitor API calls directly - While CloudWatch is powerful for monitoring and alerting, it is not primarily designed for logging API calls. It can capture logs from other services but does not provide the comprehensive logging that CloudTrail does.
C: Use AWS Config to track AWS resource changes - AWS Config focuses on resource configurations and compliance, not specifically on logging API calls. It tracks changes to resources rather than the API calls that initiated those changes.
D: Enable VPC Flow Logs for monitoring API traffic - VPC Flow Logs capture information about the IP traffic going to and from network interfaces in a VPC. This does not include detailed information about API calls, making it unsuitable for logging API actions for compliance.
The concept behind it
The underlying principle is that AWS CloudTrail is the service dedicated to logging API calls. It records these actions across your AWS account, allowing for compliance with various regulatory requirements. Understanding the specific use cases for each AWS service helps in making informed decisions.
Exam trap to remember
Always choose AWS CloudTrail for logging API calls when compliance is required. It’s the go-to service for ensuring you capture and retain necessary API activity logs.