DEA-C01 Question 525
Select 3You are a data engineer tasked with designing a centralized logging solution for your organization's AWS environment. The organization wants to collect, store, and analyze logs from multiple AWS accounts and regions to ensure compliance and security. Which combination of services and configurations should you use to achieve this?
- A
Enable AWS CloudTrail in all accounts and configure a centralized S3 bucket with cross-account access.
- B
Use AWS CloudWatch Logs to create log groups in each account and region, then configure subscription filters to send logs to a central Kinesis Data Firehose.
- C
Set up AWS Organizations and enable centralized logging through AWS Control Tower.
- D
Use an Amazon OpenSearch Service (formerly Elasticsearch) domain to directly ingest logs from all accounts and regions without additional configurations.
- E
Configure AWS Config in all accounts to generate configuration compliance logs and centralize them using an aggregator in the master account.
Show answer and explanation
Correct answers: A, B, E
Explanation
A centralized logging solution in AWS often involves combining multiple services to handle different types of logs. CloudTrail logs API activity, CloudWatch Logs can centralize application and service logs, and AWS Config manages configuration compliance logs. By using a combination of these services and configuring cross-account and cross-region setups, you can meet the requirements for centralized logging in a multi-account AWS environment.
- A. Correct.
Correct: AWS CloudTrail can track API activity and events across accounts, and centralizing logs in an S3 bucket with cross-account access ensures a centralized logging solution.
- B. Correct.
Correct: Using CloudWatch Logs with subscription filters to stream logs to a central Kinesis Data Firehose allows for real-time log centralization and analytics.
- C. Incorrect.
Incorrect: AWS Control Tower provides governance and account setup but does not directly handle centralized logging for logs like CloudTrail or CloudWatch Logs.
- D. Incorrect.
Incorrect: OpenSearch Service is used for log analysis but cannot directly ingest logs from all accounts and regions without additional services like Kinesis or Logstash.
- E. Correct.
Correct: AWS Config provides configuration compliance logs, and aggregating these logs in the master account ensures they are centralized.