A financial services company needs to ensure that all administrative activities and API calls across their AWS accounts are logged and immutable for auditing and compliance purposes. They also require a centralized view of these logs across multiple accounts. What is the most effective and compliant solution?
- AUse CloudWatch Logs to collect all application logs and configure cross-account log sharing.
- BDeploy a custom logging agent on all EC2 instances to send system logs to a central Elasticsearch cluster.
- CConfigure S3 server access logging for all S3 buckets storing application data.
- DEnable AWS CloudTrail in each account, configure an organization trail, and deliver logs to a central S3 bucket in a logging account.
Show answer & explanationAnswer & explanation
Correct answer: D. Enable AWS CloudTrail in each account, configure an organization trail, and deliver logs to a central S3 bucket in a logging account.
AWS CloudTrail is the primary service for auditing AWS API calls and administrative activities. By enabling an organization trail in AWS Organizations, all management events and optionally data events across all member accounts are automatically logged to a specified central S3 bucket. This ensures immutability (via S3 versioning and WORM policies) and provides a centralized, compliant view for auditing.
Why the other options are wrong
- A. CloudWatch Logs primarily centralizes application and system logs, not AWS API call logs. While cross-account sharing is possible, it's not the dedicated service for auditing AWS API calls.
- B. This solution focuses on system logs from EC2 instances and is not designed to capture or centralize AWS API calls and administrative activities across an organization.
- C. S3 server access logging only logs requests made to S3 buckets, not administrative activities or API calls across all AWS services.
CloudTrail Organization Trail
A CloudTrail trail that logs management and data events for all AWS accounts in an AWS Organization, delivering logs to a centralized S3 bucket.
- Centralizes logging for all member accounts.
- Captures API calls and administrative actions.
- Essential for auditing and compliance across organizations.
Memory trick: CloudTrail Org Trail: All AWS actions, one audit bucket.