SAP-C02 Question 113
Single answerAn organization uses a multi-account AWS environment managed through AWS Organizations. They want to centralize event notifications for critical actions, such as changes to IAM policies and unauthorized API calls, from all member accounts into a single account for monitoring and auditing purposes. Which solution will meet this requirement with minimal operational overhead?
- A
Create an Amazon SNS topic in the central monitoring account. Configure member accounts to send CloudTrail logs to the central account, and use an AWS Lambda function to parse and forward critical events to the SNS topic.
- B
Enable AWS CloudTrail in all member accounts and configure each trail to deliver logs to an S3 bucket in the central account. Use EventBridge in the central account to monitor the S3 bucket for changes and notify an SNS topic for critical events.
- C
Use AWS Organizations to enable AWS CloudTrail in all accounts with an organization-wide trail. Configure Amazon EventBridge in the central account to receive critical events from all member accounts and route them to an SNS topic.
- D
Set up AWS Config rules in all member accounts to detect critical actions and deliver notifications to an SNS topic in the central account.
Show answer and explanation
Correct answer: C
Explanation
The most efficient and scalable solution for centralizing event notifications in a multi-account AWS environment is to use AWS Organizations to enable a centralized CloudTrail. This allows critical events from all member accounts to be sent to Amazon EventBridge in the central account. EventBridge can then route these events to an SNS topic for notification, ensuring minimal operational overhead while providing comprehensive event monitoring.
- A. Incorrect.
This option requires creating a Lambda function to parse and forward events, which adds operational overhead. Additionally, directly configuring member accounts to send logs to the central account is not the most efficient solution in a multi-account setup.
- B. Incorrect.
This option involves delivering CloudTrail logs to an S3 bucket and then monitoring the bucket for changes, which introduces unnecessary complexity. EventBridge can directly monitor events without relying on S3.
- C. Correct.
This is the correct solution. AWS Organizations allows enabling a centralized CloudTrail for the entire organization, which can send events to EventBridge in the central account. EventBridge can then route critical events to an SNS topic for notifications, minimizing operational overhead.
- D. Incorrect.
While AWS Config can detect configuration changes, it is not designed to capture all types of critical actions, such as unauthorized API calls. Using EventBridge with CloudTrail provides a more comprehensive solution for event notifications.