SCS-C02 Question 171
Single answerYour organization has recently enabled AWS CloudTrail to capture API activity logs across all AWS accounts in the organization. The logs are being sent to an Amazon S3 bucket. The security team wants to analyze these logs to identify any suspicious activity, such as unauthorized access attempts or unusual API usage patterns. Which service or tool should the team use to efficiently query the logs stored in the S3 bucket?
- A
Amazon Athena
- B
AWS CloudWatch Logs Insights
- C
AWS Config
- D
AWS Trusted Advisor
Show answer and explanation
Correct answer: A
Explanation
Amazon Athena is the best choice for analyzing CloudTrail logs stored in an S3 bucket, as it provides on-demand querying capabilities using SQL without requiring any infrastructure setup. The other options are either designed for different purposes or are not compatible with logs stored in S3.
- A. Correct.
Amazon Athena is a serverless query service that allows you to analyze data directly in Amazon S3 using SQL queries. It is an ideal tool for querying CloudTrail logs stored in an S3 bucket.
- B. Incorrect.
AWS CloudWatch Logs Insights is used for analyzing log data stored in CloudWatch Logs, not logs stored in S3 buckets. This makes it unsuitable for analyzing CloudTrail logs in this scenario.
- C. Incorrect.
AWS Config is a service for tracking resource configurations and compliance, not for querying log data.
- D. Incorrect.
AWS Trusted Advisor provides best practice recommendations for cost optimization, security, and performance, but it does not offer log analysis capabilities.