A retailer runs 60 AWS accounts. Application teams write logs to CloudWatch Logs log groups in their own accounts, and the central security team needs every application log group streamed to its SIEM, which reads from one Amazon Data Firehose delivery stream in the logging account.
The logs must reach the SIEM within a few minutes, and the team does not want to maintain any forwarding code. Teams must not give the central team IAM access to their accounts, and the setup must be repeatable in all 60 accounts from one template, so that new accounts start streaming without help from the central team.
Which solution meets these requirements?
Choose one answer.
AA. Create a subscription filter in the logging account for each application log group in the other accounts, so that the central account pulls the logs from those groups.
BB. Run a Lambda function in each account that reads every new log event, batches it, retries failures, and forwards it to the Firehose stream in the logging account.
CC. In the logging account, create the Firehose stream, a Logs destination for it, and a destination policy for the organization. Create a subscription filter to that destination in each source account.
DD. Export each application log group to an Amazon S3 bucket once per day, using an export task scheduled in each account, and have the SIEM read the exported files from that bucket in batches.
Show the answer and explanation
Answer: C
A. Wrong: A subscription filter must be created in the account that owns the log group, and it cannot pull logs from other accounts. This option would also give the central team access into every application account.
B. Wrong: This can deliver the events, but the function is forwarding code that the team would maintain in 60 accounts, which it wants to avoid. A subscription filter sends the events without custom code.
C. Right: Correct. A cross-account destination lets each source account send log events to the logging account without any access into it, and the destination policy limits who may subscribe. The subscription filters deploy from one template, so new accounts start streaming without help from the central team. Learn more: Real-time subscriptions for CloudWatch Logs (opens in a new tab)
D. Wrong: Daily exports are far slower than the few-minute requirement. Export tasks also do not stream, so the SIEM would receive the logs late and in large batches.
Explanation
Real-time delivery across accounts uses a destination in the logging account, with a policy that names the accounts allowed to subscribe, and a subscription filter in each source account. The setup is repeatable from one template and needs no access into the application accounts. Subscriptions created in the wrong account, custom forwarders and daily exports each miss a requirement.
Want more on Organization-wide logging (CloudTrail organization trails, log archive account)? The 5 full-length practice sets have 7 more Organization-wide logging (CloudTrail organization trails, log archive account) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →