AWS Certified Security – SpecialtyDomain 2: Logging and MonitoringMedium
A security engineer is troubleshooting an issue where a Lambda function, intended to process S3 object creation events, is not being invoked. The engineer suspects a misconfiguration in the event source mapping or permissions. To diagnose this, the engineer needs to view the execution logs of the Lambda function, including any errors or output, and also verify if the S3 event is correctly triggering the Lambda function. Which AWS services should the engineer check?
- AAmazon S3 Event Notifications to verify configuration and AWS CloudTrail to check Lambda function execution.
- BAWS CloudTrail to check S3 PutObject events and Amazon S3 Access Logs to check Lambda invocation.
- CAWS CloudWatch Logs for Lambda function execution logs and AWS CloudTrail to verify S3 event delivery to Lambda.
- DAWS X-Ray for Lambda traces and VPC Flow Logs to check network connectivity.
Show answer & explanationAnswer & explanation
Correct answer: C. AWS CloudWatch Logs for Lambda function execution logs and AWS CloudTrail to verify S3 event delivery to Lambda.
Lambda function execution logs, including errors and output, are sent to CloudWatch Logs. CloudTrail records API calls, including when S3 sends an event notification to Lambda (which is an API call to invoke Lambda), allowing verification of the event delivery and invocation attempt.
Why the other options are wrong
- A. S3 Event Notifications are the configuration itself, not a log of events. CloudTrail records the invocation, but not the detailed execution logs of Lambda.
- B. S3 Access Logs record requests made to S3 buckets, not Lambda invocation status or execution logs. CloudTrail would show S3 events, but not Lambda's internal execution.
- D. AWS X-Ray provides distributed tracing, which could be helpful for performance but isn't the primary source for basic execution logs or event delivery verification. VPC Flow Logs are for network traffic, not Lambda invocation or execution issues.
Lambda Logging & Monitoring
AWS Lambda integrates with CloudWatch Logs for function execution logs and CloudTrail for invocation events.
- CloudWatch Logs stores function output and errors
- CloudTrail records API calls, including Lambda invocations
- Essential for troubleshooting serverless applications
Memory trick: CloudWatch shows what Lambda did, CloudTrail shows who called it.