Investigators need to search events across accounts and Regions.
Avoid manually loading S3 files and support SQL filters by principal, action, and time.
Which audit-log approach is most appropriate?
Ingest events into a CloudTrail Lake event data store and define retention and query permissions.
Detailed explanation
Transfer, confidentiality, and repeatability risks increase.
Transfer, confidentiality, and repeatability risks increase.
Events can be retained and queried across accounts and Regions with SQL.
Events can be retained and queried across accounts and Regions with SQL.
Storage-class changes do not provide event queries or correlation.
Storage-class changes do not provide event queries or correlation.
Metrics aggregate values and do not retain event details.
Metrics aggregate values and do not retain event details.
Check official documentation
Compare the following points with the official documentation.
AWS CloudTrail Lake event data store、SQL queries、retentionの公式説明を確認する。
What to confirm
保存先移行とイベント検索・相関分析の違いを説明できる。
Key points
- CloudTrail Lake
- Event data store
- SQL
- Retention
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Audit detail
Filter by principal, session, resource, error, and time when reconstructing an action.
Evidence protection
Separate query permission from delete and retention-change permission.