DEA-C01 Question 526
Select 3Your organization wants to centralize all AWS logs from multiple accounts into a single account for better monitoring and compliance. Which combination of AWS services and features should you use to achieve this?
- A
AWS CloudTrail with an S3 bucket in the central account and cross-account permissions
- B
Amazon CloudWatch Logs with cross-account subscriptions and centralized log group in the central account
- C
AWS Config with an aggregator in the central account and cross-account data sharing enabled
- D
AWS Kinesis Data Firehose to stream logs from each account into a centralized S3 bucket
- E
AWS Lambda function to periodically transfer logs from individual account buckets to the central account bucket
Show answer and explanation
Correct answers: A, B, C
Explanation
To centralize AWS logs across multiple accounts, you can use AWS CloudTrail for delivering S3 logs, Amazon CloudWatch Logs for centralized log analytics, and AWS Config aggregators for compliance and configuration data. These services provide native cross-account capabilities, scalability, and integration, making them the best solution for centralized log management and monitoring. Kinesis Data Firehose and Lambda are not ideal for this purpose due to complexity and inefficiency.
- A. Correct.
Correct. AWS CloudTrail can be configured to deliver logs from multiple accounts into an S3 bucket in a central account by using cross-account permissions.
- B. Correct.
Correct. Amazon CloudWatch Logs supports cross-account log data sharing using subscription filters and centralized log groups.
- C. Correct.
Correct. AWS Config aggregators allow you to collect configuration and compliance data from multiple accounts into a central account.
- D. Incorrect.
Incorrect. While Kinesis Data Firehose can stream logs to an S3 bucket, it is not a commonly used service for centralized log collection in this scenario compared to CloudTrail or CloudWatch Logs.
- E. Incorrect.
Incorrect. Using a Lambda function for periodic log transfer is less efficient, introduces latency, and is not recommended compared to the native cross-account capabilities of AWS logging services.