AWS Certified SysOps Administrator – AssociateMonitoring, Logging, and RemediationMedium
A security team requires real-time alerts whenever a user attempts to log in to an AWS account using root credentials. The alerts must be sent to an Amazon SNS topic for multiple subscribers. How can a SysOps administrator configure this monitoring and alerting solution?
- ASet up an AWS Systems Manager Automation document to periodically check for root login events and publish to SNS.
- BEnable AWS Trusted Advisor checks for root account usage and configure email notifications.
- CConfigure an Amazon CloudWatch alarm on a custom metric derived from AWS Config rules for root user activity.
- DCreate an Amazon EventBridge rule that filters AWS CloudTrail events for root login attempts and targets an SNS topic.
Show answer & explanationAnswer & explanation
Correct answer: D. Create an Amazon EventBridge rule that filters AWS CloudTrail events for root login attempts and targets an SNS topic.
AWS CloudTrail records all API calls and events in an AWS account, including root user logins. Amazon EventBridge can be used to filter these CloudTrail events in near real-time and route them to an SNS topic for notifications.
Why the other options are wrong
- A. Systems Manager Automation is for operational tasks and runbooks, not for real-time event filtering and alerting based on CloudTrail logs.
- B. Trusted Advisor provides checks for best practices, including root account use, but it's not designed for real-time alerting on specific login *attempts* and doesn't integrate directly with SNS for this purpose.
- C. AWS Config is for compliance checking and resource configuration, not real-time event filtering for login attempts. CloudWatch custom metrics would be complex and less direct for this specific event.
CloudTrail with EventBridge for Alerts
AWS CloudTrail records API calls and events. Amazon EventBridge can filter these CloudTrail events in near real-time, allowing for automated responses like sending alerts via Amazon SNS.
- CloudTrail logs all account activity.
- EventBridge is an event bus for routing events.
- Can filter specific CloudTrail events (e.g., root login).
- Integrates with SNS for real-time notifications.
Memory trick: CloudTrail sees the login, EventBridge sends the alert.