SCS-C02 Question 122
Select 3An organization wants to implement a centralized logging solution for their multi-account AWS environment. They need to collect and analyze logs from AWS CloudTrail and Amazon VPC Flow Logs across all accounts while ensuring compliance and secure access to the logs. Which of the following steps should be included to design an effective logging solution?
- A
Enable AWS CloudTrail in each account and configure it to deliver logs to a centralized Amazon S3 bucket in a designated logging account.
- B
Use AWS Organizations to automatically enable AWS CloudTrail and Amazon VPC Flow Logs for all member accounts.
- C
Configure an Amazon S3 bucket policy in the logging account to allow cross-account access for log delivery from other accounts.
- D
Use AWS Glue to directly pull logs from all accounts and store them in Amazon S3 for centralized analysis.
- E
Enable Amazon S3 server-side encryption (SSE) to secure logs stored in the centralized bucket.
Show answer and explanation
Correct answers: A, C, E
Explanation
To design an effective logging solution in a multi-account AWS environment, logs from AWS CloudTrail and VPC Flow Logs should be centralized in an Amazon S3 bucket in a designated logging account. AWS CloudTrail must be enabled in each account, and the S3 bucket should have a bucket policy to allow cross-account log delivery. Additionally, enabling server-side encryption for the S3 bucket ensures that logs are stored securely in compliance with security best practices.
- A. Correct.
Correct. Enabling CloudTrail in each account and delivering logs to a centralized S3 bucket is a best practice for centralized logging in multi-account environments.
- B. Incorrect.
Incorrect. AWS Organizations can enable AWS CloudTrail for member accounts, but it cannot directly enable VPC Flow Logs. Additional configuration is required for VPC Flow Logs.
- C. Correct.
Correct. Configuring an S3 bucket policy to allow cross-account access ensures that logs from multiple accounts can be securely delivered to the centralized bucket.
- D. Incorrect.
Incorrect. AWS Glue is not used for log delivery; it is used for ETL (Extract, Transform, Load) and data transformation tasks.
- E. Correct.
Correct. Enabling S3 server-side encryption ensures that logs stored in the centralized bucket are encrypted at rest, which is critical for compliance and security.