Logging Solutions

• A trail logs management events by default, but data and Insights events cost extra and are off
• CloudTrail logs four event types, each a different layer
• Event history keeps only 90 days of management events and can't be turned on retroactively
• Use a multi-Region trail so one trail captures every enabled Region
• An organization trail logs every account and members can't disable it
• Centralize logs in a dedicated account workloads can write to but not read or delete
• Enable log file integrity validation to prove logs weren't altered
• Lock the log bucket with S3 Object Lock compliance mode to survive a malicious admin
• S3 MFA Delete adds an MFA token requirement to delete a version
• VPC Flow Logs capture traffic metadata, not packet payloads
• Create a flow log at the VPC, subnet, or ENI level
• Use Route 53 Resolver query logs to catch DNS-based exfiltration and C2
• Transit Gateway Flow Logs cover traffic crossing the transit gateway
• Add application-layer access logs for HTTP-level evidence
• Security Lake normalizes sources to OCSF Parquet in your own S3
• Security Lake subscribers get either query access or data access
• Use a CloudTrail Lake event data store for queryable, immutable long-term history
• Pick CloudWatch Logs Insights for fast interactive triage on live logs
• Use Athena for cheap SQL over logs sitting in S3
• Reach for OpenSearch Service when you need full-text search and SIEM-style dashboards
• Lambda, Managed Grafana, and OpenSearch are the normalize-parse-correlate toolkit
• A Logs Insights top-N query is filter, then stats ... by field, then sort desc, then limit
• Group a Logs Insights count by bin(15m) to get a time-series, and filter again after stats to threshold it
• Use pkt-srcaddr/pkt-dstaddr to see the original pre-NAT IPs in a flow log
• A cross-account CloudWatch Logs destination needs a destination access policy for senders
• Firehose invokes the transform Lambda synchronously with a 6 MB limit and routes failures to a backup folder
• Route 53 Resolver query logging records only unique queries, not cache hits

Unlock with Premium — includes all practice exams and the complete study guide.