Application, Glue, and VPC Flow Logs must be collected in a central analytics account.
Do not copy each log group manually.
Which audit-log approach is most appropriate?
Use CloudWatch Logs subscription filters with Firehose or another destination and protect the central store.
Detailed explanation
Events are continuously filtered and delivered to centralized S3 or OpenSearch storage.
Events are continuously filtered and delivered to centralized S3 or OpenSearch storage.
CloudTrail records AWS API events, not arbitrary application logs.
CloudTrail records AWS API events, not arbitrary application logs.
Delay, omissions, and operational effort increase.
Delay, omissions, and operational effort increase.
Lifecycle manages S3 objects and does not stream CloudWatch Logs.
Lifecycle manages S3 objects and does not stream CloudWatch Logs.
Check official documentation
Compare the following points with the official documentation.
Amazon CloudWatch Logs subscription filters、Kinesis Data Firehose、central loggingの公式説明を確認する。
What to confirm
手動コピー・S3 Lifecycle・CloudTrailと継続ログ転送の違いを説明できる。
Key points
- Subscription filter
- Firehose
- Central logging
- Retry
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Delivery assurance
Design for destination outage, throttling, duplicate events, and a failed-record path.
Object Lock
S3 retention controls that help prevent an audit object from being deleted or overwritten.