AWS Centralized Logging Architecture – CloudTrail, Security Lake & SIEM

AWS Centralized Logging Architecture — Overview

Centralized logging is a foundational security requirement across all AWS certifications. The SCS-C03 exam tests your ability to design multi-account logging architectures that aggregate, correlate, and alert on security events. This post covers the complete logging pipeline: from source collection (CloudTrail, VPC Flow Logs, DNS logs) through aggregation (Security Lake, CloudWatch) to analysis (Athena, OpenSearch, SIEM).

Log Sources — What to Collect

Organization CloudTrail Trail

• Setup: Create from the management account → automatically applies to ALL member accounts
• Storage: Central S3 bucket in Log Archive account with bucket policy allowing organization trail delivery
• Protection: S3 Object Lock (WORM), MFA Delete, bucket policy denying s3:DeleteObject, KMS encryption
• Validation: CloudTrail log file integrity validation (SHA-256 hash chain). Detects if log files are modified/deleted.
• Key exam trap: Member accounts can see the trail but CANNOT modify or delete it. Only the management account can.

Cross-Account Log Aggregation Patterns

Amazon Security Lake (OCSF)

• What: Centralized security data lake that automatically collects logs from 80+ AWS and third-party sources
• Schema: Normalizes ALL data to Open Cybersecurity Schema Framework (OCSF) — single schema regardless of source
• Storage: S3 with Apache Iceberg tables (efficient querying, time-travel)
• Sources: CloudTrail, VPC Flow Logs, Route 53, Security Hub, Lambda execution, S3 data events, EKS audit, WAF
• Subscribers: Query via Athena, or grant data access to third-party SIEMs (Splunk, Datadog, CrowdStrike)
• Multi-account: Delegated administrator collects from all Organization member accounts automatically
• Regions: Rollup regions — aggregate from multiple regions into one central region
• Exam relevance: “Normalize logs from multiple sources into a unified schema” → Security Lake

CloudWatch Logs — Real-Time Analysis

• Metric Filters: Parse log events → extract metrics → create alarms (e.g., count of “UnauthorizedAccess” → alarm if > 5/min)
• Subscription Filters: Stream logs in real-time to Lambda, Kinesis, Firehose, or OpenSearch
• Cross-Account Subscriptions: Source account creates subscription filter → sends to destination in central account (Kinesis/Firehose)
• Insights Queries: SQL-like queries across log groups. Find patterns, anomalies, top talkers.
• Data Protection: Mask sensitive data (SSN, credit cards) in logs automatically using data protection policies
• Retention: Configure per log group (1 day to 10 years, or never expire). Exam: default is never expire (costs money!).

Log Protection — Integrity & Access Control

Exam Tips

AWS Certification Exam Practice Questions

Question 1:

A security engineer needs to ensure that API activity logs from all 50 AWS accounts in the organization cannot be modified or deleted, even by administrators in those accounts. The logs must be retained for 7 years. Which solution meets these requirements?

1. Create individual CloudTrail trails in each account sending to a local S3 bucket with versioning enabled
2. Create an organization trail sending to an S3 bucket in a dedicated Log Archive account with S3 Object Lock in Compliance mode
3. Create an organization trail sending to CloudWatch Logs with a 7-year retention policy
4. Create individual trails with log file integrity validation enabled and MFA Delete on each bucket

Question 2:

A company needs to detect within 1 minute when someone disables CloudTrail logging in any account. The detection must trigger an automated Lambda function to re-enable the trail. Which approach achieves this?

1. AWS Config rule checking CloudTrail status with auto-remediation via SSM
2. Organization trail → CloudWatch Logs → metric filter for StopLogging → alarm → SNS → Lambda
3. EventBridge rule in each member account for StopLogging/DeleteTrail events → central event bus → Lambda
4. GuardDuty finding for “Stealth:IAMUser/CloudTrailLoggingDisabled” → EventBridge → Lambda

Question 3:

A company wants to aggregate security logs from CloudTrail, VPC Flow Logs, Route 53 DNS logs, and GuardDuty findings into a single data store. They need to query all sources with a unified schema. Third-party security tools must also access this data. Which solution provides this?

1. Send all logs to a central S3 bucket, create Glue crawlers for each source, query with Athena
2. Send all logs to CloudWatch Logs in a central account, use CloudWatch Logs Insights
3. Enable Amazon Security Lake with delegated administrator, configure subscriber access for third-party tools
4. Send all logs to Amazon OpenSearch Service with custom index templates per source

Question 4:

A security team needs to analyze VPC Flow Logs across 100 accounts to find connections to known malicious IPs. The logs are stored in S3 in a central account. They want the lowest-cost query solution that doesn’t require infrastructure management. Which approach is best?

1. Import logs into Amazon OpenSearch Service and create dashboards
2. Use Amazon Athena with partitioned tables (by account, date, region) to query directly from S3
3. Stream to Amazon Kinesis Data Analytics for real-time threat detection
4. Load into Amazon Redshift for analytics queries

Question 5:

A company’s CloudWatch Logs contain sensitive PII (Social Security numbers) from application logs. The security team needs to ensure PII is masked in log output while still allowing full log access for authorized incident responders. Which approach meets both requirements?

1. Create a Lambda function to process logs before ingestion, redacting PII patterns
2. Configure CloudWatch Logs data protection policy to mask SSN patterns, grant unmask permission to incident response IAM role
3. Encrypt logs with KMS key accessible only to incident responders
4. Create two separate log groups — one with PII (restricted) and one without (general access)

Related Posts

• Config vs CloudTrail vs CloudWatch Compared
• Security Services Architecture – GuardDuty & Security Hub
• Multi-Account Architecture
• Data Lake & Analytics Architecture
• Incident Response Architecture
• IAM Security Architecture

References

• Creating an Organization Trail — AWS Docs
• Amazon Security Lake User Guide
• Centralized Flow Log Data — AWS Security Blog
• Log Archive Account — AWS Security Reference Architecture

Frequently Asked Questions

What is the difference between CloudTrail and VPC Flow Logs?

CloudTrail logs API calls (who created/modified/deleted AWS resources). VPC Flow Logs capture network traffic metadata (source/destination IPs, ports, accepted/rejected). CloudTrail tells you “who changed the security group rule.” Flow Logs tell you “what traffic is flowing through the network.” Both are essential for security — they answer different questions.

Security Lake vs manually sending logs to S3?

Security Lake automatically collects from 80+ sources, normalizes everything to the OCSF schema (unified format), partitions data for efficient querying, and supports direct subscriber access for SIEMs. Manual S3 aggregation requires you to set up each source individually, manage different schemas, and build custom integrations. Security Lake is the managed approach for organizations with multiple log sources and SIEM requirements.

How do I protect logs from being deleted by compromised admin accounts?

Three layers: (1) Separate Log Archive account — workload account admins have no access. (2) S3 Object Lock Compliance mode — even root cannot delete until retention expires. (3) Organization trail — member accounts cannot modify or delete it. Additionally, enable log file integrity validation to detect tampering, and create EventBridge rules to alert on any StopLogging/DeleteTrail API calls.