AWS Certified Security – SpecialtyDomain 2: Logging and MonitoringMedium
A security engineer has configured an AWS WAF Web ACL to protect a public-facing web application. To monitor the effectiveness of WAF rules and identify potential attack patterns, the engineer needs to enable detailed logging of all web requests that WAF inspects. The logs should be easily accessible for real-time analysis and long-term storage. Which destination should the engineer configure for WAF logs?
- AAWS CloudTrail to capture WAF API calls.
- BAmazon S3 bucket configured with lifecycle policies.
- CAWS CloudWatch Logs log group.
- DAmazon Kinesis Data Firehose delivery stream.
Show answer & explanationAnswer & explanation
Correct answer: D. Amazon Kinesis Data Firehose delivery stream.
AWS WAF logs are best sent to an Amazon Kinesis Data Firehose delivery stream. Firehose can then deliver these logs to various destinations like Amazon S3 for long-term storage and data lakes, Amazon Redshift for analytics, or Amazon OpenSearch Service for real-time analysis and visualization, fulfilling both real-time and long-term requirements effectively.
Why the other options are wrong
- A. AWS CloudTrail records API calls made to WAF (e.g., creating/updating rules), not the actual web requests that WAF inspects.
- B. While S3 can store logs, it's generally not ideal for real-time analysis directly. Firehose provides a more robust ingestion layer before S3 for WAF logs.
- C. CloudWatch Logs can receive WAF logs, but for large volumes and flexible integration with analytics services (like OpenSearch Service for real-time analysis), Kinesis Data Firehose is often a more scalable and versatile choice, especially when also considering long-term archival to S3.
AWS WAF Logging
Enabling detailed logging of web requests processed by AWS WAF to monitor rule effectiveness and identify attack patterns.
- Logs include request details, rule actions, and labels
- Essential for security analysis and tuning WAF rules
- Kinesis Data Firehose is the primary delivery mechanism
Memory trick: WAF logs flow like fire, to S3 or OpenSearch higher.