AWS Certified Data Engineer – AssociateData Governance and SecurityMedium
A financial institution is building a data warehouse on Amazon Redshift. Due to strict regulatory compliance requirements, all access to the data must be logged and audited, including successful and failed login attempts, as well as all SQL queries executed. Which AWS services should be configured to meet these auditing requirements for Redshift?
- AAmazon CloudWatch Logs and AWS Config
- BAmazon GuardDuty and AWS Security Hub
- CAWS CloudTrail and Amazon Kinesis Data Firehose
- DAWS CloudTrail and Amazon S3
Show answer & explanationAnswer & explanation
Correct answer: D. AWS CloudTrail and Amazon S3
AWS CloudTrail records API calls and events for AWS services, including Redshift login attempts and SQL queries, delivering logs to an S3 bucket for long-term storage and analysis. This directly addresses the auditing requirements.
Why the other options are wrong
- A. CloudWatch Logs aggregates and monitors logs, but CloudTrail is specifically for auditing API events. AWS Config assesses resource compliance, not event logging.
- B. GuardDuty is a threat detection service, and Security Hub is for security posture management; neither directly provides detailed Redshift login and query auditing.
- C. Kinesis Data Firehose is for streaming data to destinations, not the primary service for capturing AWS service events for auditing.
AWS CloudTrail
AWS CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. It logs API calls and related events.
- Records actions taken by a user, role, or an AWS service
- Logs are delivered to an S3 bucket
- Provides event history of your AWS account activity
Memory trick: CloudTrail logs, S3 stores, for audit success.