A company needs to aggregate Amazon CloudWatch logs from its AWS accounts into one central logging account. The collected logs must remain in the AWS Region of creation. The central logging account will then process the logs, normalize the logs into standard output format, and stream the output logs to a security tool for more processing. A solutions architect must design a solution that can handle a large volume of logging data that needs to be ingested. Less logging will occur outside normal business hours than during normal business hours. The logging solution must scale with the anticipated load. The solutions architect has decided to use an AWS Control Tower design to handle the multi-account logging process. Which combination of steps should the solutions architect take to meet the requirements? (Choose three.)
Select 3 answers.
Marked answer: A
This question asks for 3 answers, but our data marks only 1. Compare with the community discussion below for the full answer.
Community Discussion
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
1
While SQS does not fit the bill as it is not a direct location to send CW logs, KDS too does not fit the bill because it cannot scale automatically with load and one has to keep adding shards to increase the throughput. The authors themselves are not that knowledgeable. Only KDF seems to be the most correct thing to do(not mentioned in the options) as it can scale automatically as well has the transformation feature.
1
BDE Why would you write to the member account? makes no sense. Why would you use kinesis it says nothing about real time. BD
1
Kinesis data stream is a possible destination of CloudWatch Logs subscriptions, but SQS isn't
