SAP-C02 Question 112
Select 2Your organization has a multi-account setup managed using AWS Organizations. You need to centrally monitor specific events, such as IAM role modifications and changes to security groups, across all member accounts. The solution must ensure that notifications are sent to a centralized account for analysis and compliance. Which of the following steps should you take to implement this requirement?
- A
Create an Amazon EventBridge event bus in the central account and configure member accounts to send events to this event bus.
- B
Set up a CloudTrail trail in each member account and configure it to deliver logs to an S3 bucket in the central account.
- C
Use AWS Config in each member account to record configuration changes and send logs to the central account's S3 bucket.
- D
Attach a policy to the event bus in the central account to allow member accounts to put events into it.
- E
Enable trusted access for AWS Organizations on Amazon EventBridge to allow automatic integration of event buses across accounts.
Show answer and explanation
Correct answers: A, D
Explanation
To centralize event notifications across multiple accounts, you can leverage Amazon EventBridge. A central event bus is created in the management account, and member accounts are configured to forward specific events to this bus. Permissions must be explicitly granted through a resource policy on the event bus to allow member accounts to send events. This approach enables real-time monitoring and compliance enforcement for events across the organization.
- A. Correct.
Correct: Creating an EventBridge event bus in the central account allows member accounts to send events to a centralized location for monitoring.
- B. Incorrect.
Incorrect: While CloudTrail logs can provide detailed audit trails of certain actions, they do not enable real-time event notifications or centralized event routing.
- C. Incorrect.
Incorrect: AWS Config tracks resource configurations but does not directly support real-time event notifications or routing to an EventBridge event bus in a central account.
- D. Correct.
Correct: A policy attached to the central event bus is required to grant permissions for member accounts to send events to it.
- E. Incorrect.
Incorrect: EventBridge does not support trusted access via AWS Organizations for automatic integration of event buses. Configuration must be done manually.