DEA-C01 Question 527
Select 3Your organization uses multiple AWS accounts for different teams. You have been tasked with creating a centralized logging solution to collect and analyze AWS CloudTrail logs from all accounts in a single location. Which combination of services and configurations should you use to achieve this goal?
- A
Enable AWS Organizations and configure a central S3 bucket with proper permissions to receive logs from all member accounts.
- B
Configure CloudTrail in each member account to deliver logs to the central S3 bucket.
- C
Use AWS Glue to automatically ingest and transform the CloudTrail logs stored in the central S3 bucket for analysis.
- D
Enable CloudWatch Logs Insights to directly query the CloudTrail logs from each member account.
- E
Use Amazon Athena to query the centralized CloudTrail logs stored in the central S3 bucket.
Show answer and explanation
Correct answers: A, B, E
Explanation
To implement a centralized logging solution for AWS CloudTrail logs, you need to enable AWS Organizations for managing multiple accounts and set up a central S3 bucket with the correct permissions to receive logs from all member accounts. Each account’s CloudTrail must be configured to send logs to this bucket. Once the logs are centralized, Amazon Athena provides an efficient way to query and analyze the data directly from S3.
- A. Correct.
Correct: Enabling AWS Organizations allows you to manage multiple accounts centrally, and a central S3 bucket can be used to collect logs when configured with the appropriate policies and permissions.
- B. Correct.
Correct: Each member account’s CloudTrail must be configured to deliver logs to the central S3 bucket for centralized logging.
- C. Incorrect.
Incorrect: AWS Glue is mainly used for ETL (Extract, Transform, Load) processes and is not required for simply collecting and querying CloudTrail logs in this scenario.
- D. Incorrect.
Incorrect: CloudWatch Logs Insights does not directly query logs across multiple accounts. Logs must first be centralized in a single location, such as an S3 bucket, for analysis.
- E. Correct.
Correct: Amazon Athena can query data stored in S3 directly, making it a suitable tool for analyzing the centralized CloudTrail logs.