A video streaming service sends application logs from its playback servers to CloudWatch Logs. Engineers search the last 90 days of logs during incidents, and the compliance team needs logs kept for seven years at the lowest storage cost.
Security requires that every log group be encrypted with a customer managed KMS key, and the seven-year copies must be stored in a bucket that is not used for any other purpose.
The team wants the archive to fill itself with no nightly job to run or maintain.
Which configuration meets these requirements?
Choose one answer.
AA. Keep all logs in CloudWatch Logs with retention set to never expire, encrypted with the default AWS managed key, and check the storage cost each quarter to decide when to delete data.
BB. Copy each log stream to S3 with a Lambda function that runs every minute, writing each event as its own object, and set the log groups to expire after 90 days.
CC. Run a daily CreateExportTask job for each log group, exporting the previous day's logs to S3, and keep the log groups at the default retention so that the export has time to finish.
DD. Associate a customer managed KMS key with each log group, set retention to 90 days, and add a subscription filter that sends events to Amazon Data Firehose, which writes to a dedicated S3 bucket.
A customer managed KMS key on each log group meets the encryption rule, and a 90-day retention keeps the recent logs searchable in CloudWatch. A subscription filter sends events continuously to Amazon Data Firehose, which writes to a dedicated S3 bucket where lifecycle rules manage the seven-year archive. Export tasks, custom copy functions and unlimited retention each miss one requirement.
Want more on Log collection, retention, encryption and subscriptions? The 5 full-length practice sets have 13 more Log collection, retention, encryption and subscriptions questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →