2.3 - Design and implement a logging solution (CloudTrail, Flow Logs, Athena, Logs Insights, OpenSearch)
AWS Certified Security Specialty objective 2.3 covers choosing log sources and the engine that reads them. An organization trail enabled from the management account covers every member account and cannot be turned off locally, log file integrity validation produces signed digest files that prove nothing was altered after delivery, and CloudTrail data events for S3 objects or Lambda invocations are not recorded by default, which is why an investigator sees ListBuckets but not the objects downloaded; advanced event selectors scope them to a single sensitive prefix to keep the bill sane. VPC Flow Logs report accepted and rejected traffic with an action field but carry no packet payload and omit instance metadata service, Amazon DNS and DHCP traffic, so payload capture needs VPC Traffic Mirroring and resolved domain names need Route 53 Resolver query logging. For analysis, Athena runs SQL over S3 and gets dramatically faster and cheaper with partitioning, CloudWatch Logs Insights aggregates in place with parse and stats, OpenSearch gives near real-time dashboards and full text search, and CloudTrail Lake queries years of events with no partitioning work. Object Lock plus an SCP protect the archive from a rogue administrator.
Who downloaded which object = CloudTrail data events, off by default. Prove no log file was altered = log file integrity validation and its digest files. Slow expensive Athena over CloudTrail = partition the data, by date and account.
Practice questions
1. A team wants to know which source addresses were rejected by security groups and network ACLs on a subnet. Which log answers this?
- VPC Flow Logs (correct answer)
- CloudTrail management events
- S3 server access logs
- Route 53 Resolver query logs, which capture the DNS names requested by the resources of the VPC and the responses returned to them
Flow logs record IP traffic metadata at the VPC, subnet or network interface level, including an action field valued ACCEPT or REJECT. CloudTrail records API calls rather than packets, S3 server access logs describe bucket requests, and Resolver query logs cover DNS names without any notion of a security group decision.
2. Which limitation of VPC Flow Logs must a design account for?
- They can only be delivered to Amazon S3, never to CloudWatch Logs
- They are retained for exactly 90 days and then deleted
- They must be enabled separately on each elastic network interface, since VPC level and subnet level activation are not offered by the service
- They do not capture packet contents, and some traffic such as instance metadata requests is excluded (correct answer)
Flow logs are metadata records, and traffic to the instance metadata service, to the Amazon DNS server, DHCP traffic and Windows licence activation are not captured. Destinations include CloudWatch Logs, S3 and Data Firehose, retention depends on the destination rather than a fixed 90 days, and a flow log can be attached at VPC, subnet or interface level.
3. An auditor asks for proof that CloudTrail log files have not been altered since delivery. Which feature provides it?
- Server side encryption of the S3 bucket with a customer managed KMS key
- Log file integrity validation with signed digest files (correct answer)
- S3 Versioning combined with a lifecycle policy that transitions the older versions of each object into the Glacier storage classes
- CloudTrail Insights
Integrity validation makes CloudTrail deliver hourly digest files, hashed and signed with a private key, so anyone can verify that no log file was modified or deleted. Encryption protects confidentiality but proves nothing about tampering, versioning and lifecycle rules preserve copies without cryptographic proof, and Insights detects unusual API activity.
4. An organization of 60 accounts needs CloudTrail enabled everywhere, with logs centralised and with member administrators unable to switch logging off. What should be created?
- One trail per account writing to a bucket in that same account
- An S3 replication rule copying every account bucket into a central archive bucket, with a nightly job that reconciles the objects and reports the accounts that are missing
- An organization trail created from the management account or the delegated administrator (correct answer)
- A CloudWatch Logs subscription filter in each account
An organization trail is created once, applies to every current and future member account, and cannot be modified or deleted from within a member account. Per account trails can be turned off locally, an S3 replication and reconciliation pipeline is a fragile workaround, and subscription filters move CloudWatch log data without guaranteeing that a trail exists at all.
5. Athena queries against several terabytes of CloudTrail logs in S3 are slow and expensive. Which change helps the most?
- Partition the table by region and date, and query with a partition filter (correct answer)
- Increase the Athena query timeout and run the queries during off peak hours
- Copy the whole data set into a provisioned Amazon Redshift cluster sized for the largest query the analysts have ever needed to run against the archive
- Enable S3 Transfer Acceleration on the log bucket
Athena bills by data scanned, so partitioning lets a query read only the relevant prefixes, and partition projection removes the need to load partitions manually. A longer timeout does not reduce the scan, moving everything into Redshift adds a large permanent cost for occasional queries, and Transfer Acceleration only speeds uploads over long distances.
6. An analyst wants to count failed authentication lines per source address directly in a CloudWatch log group, without moving data. Which tool fits?
- Amazon Athena pointed at the log group
- An AWS Glue crawler that catalogs the log group and exposes it as a table in the data catalog for downstream query engines
- Amazon QuickSight connected to CloudWatch
- CloudWatch Logs Insights with a stats by query (correct answer)
Logs Insights queries a log group in place with a purpose built language, and stats count by sourceIPAddress gives the answer immediately. Athena and Glue both operate on data in S3 rather than on a live log group, and QuickSight visualises data sets from sources such as Athena or S3 rather than querying CloudWatch Logs directly.