Application logs enter a Standard-class CloudWatch Logs log group in the same account and Region as the analysis Kinesis Data Streams stream. The stream and a role allowing CloudWatch Logs to write to it are ready.
Continuously deliver every newly ingested event in near real time. The analysis system needs event bodies, rather than periodic exports or aggregate query results.
Which configuration is most appropriate?
Use a Standard-class log-group subscription filter to continuously deliver new events to Kinesis Data Streams.
Detailed explanation
Counts support monitoring but do not forward event bodies to the analysis stream.
Counts support monitoring but do not forward event bodies to the analysis stream.
A prepared destination alone does not connect the log group to a delivery subscription.
A prepared destination alone does not connect the log group to a delivery subscription.
The subscription delivers matching newly ingested events; an empty pattern selects all events.
The subscription delivers matching newly ingested events; an empty pattern selects all events.
Historical batch processing does not provide the required continuous delivery of new events.
Historical batch processing does not provide the required continuous delivery of new events.
Check official documentation
Compare the following points with the official documentation.
Review Standard-class support, the Kinesis subscription setup, base64/gzip format, retries, and delivery monitoring.
Official references
What to confirm
Distinguish subscriptions from historical exports and explain decoding, duplicate handling, and delivery-error monitoring.
Key points
- Subscription filter
- Kinesis Data Streams
- Log stream
Notes
- Environment: AWS SOA-C03 exam guide and the linked AWS documentation
- Reviewed against the linked AWS documentation on 2026-10-04.
Foundation review
Check the delivery input and format
Subscriptions use Standard-class log groups. Connect the group, filter pattern, destination ARN, and delivery role. Decode base64 and decompress gzip before reading logEvents. A subscription is not a historical replay configuration.
Separate continuous delivery from completeness
Delivery is usually within minutes, not an immediate-arrival guarantee; events may be batched. Handle duplicates idempotently using event IDs where appropriate. Monitor stream capacity and DeliveryThrottling, and review retry limits and non-retryable delivery failures.