AWS Monitoring, Logging, and Auditing Architecture Patterns – SAP-C02 Study Guide

Purpose of This Lesson

Monitoring, logging, and auditing requirements often appear as architecture-selection questions in the SAP-C02 exam. The key is matching each requirement to the correct AWS service and integration pattern:

• Collecting operating-system logs and metrics from EC2 or on-premises servers
• Processing log data in real time
• Preserving audit records and detecting tampering
• Centralizing API activity across an AWS Organization
• Alerting on sensitive API activity
• Detecting and automatically correcting configuration noncompliance

Key Concepts

Collecting EC2 Logs with the Unified CloudWatch Agent

The Unified CloudWatch Agent can collect log files from EC2 instances and publish them to Amazon CloudWatch Logs. It can also collect system-level metrics beyond the default EC2 metrics, such as memory and disk utilization.

For instances in an Auto Scaling group, configure the agent through a repeatable mechanism such as a launch template, user data, or a configuration-management process. Every newly launched instance should receive the same agent configuration automatically.

The typical flow is:

EC2 instances in an Auto Scaling group
        |
        v
Unified CloudWatch Agent
        |
        v
CloudWatch Logs and CloudWatch custom metrics

The agent is useful for both AWS-hosted and on-premises servers, provided the servers have the required connectivity and IAM permissions to publish telemetry.

One-Second Metrics with High-Resolution Custom Metrics

Standard CloudWatch custom metrics commonly use a one-minute period. A requirement for one-second granularity requires high-resolution custom metrics.

Important distinctions:

• High-resolution custom metrics support sub-minute periods, including one-second periods.
• The application or monitoring agent must publish the metric with high-resolution storage enabled.
• High-resolution metrics generally cost more than standard-resolution metrics.
• The source must produce the metric data; CloudWatch does not infer one-second application metrics from ordinary one-minute metrics.

Use high resolution only where the operational requirement justifies the additional cost and data volume.

Real-Time Processing of Application Logs

CloudWatch Logs can stream log events to downstream consumers using a subscription filter. A subscription filter selects log events and forwards them to a supported destination.

For real-time processing by Lambda, the pattern is:

On-premises application
        |
        v
Unified CloudWatch Agent
        |
        v
CloudWatch Logs log group
        |
        v
Subscription filter
        |
        v
AWS Lambda

This pattern is appropriate when the requirement is event-driven processing as log events arrive, such as parsing, enrichment, alert evaluation, or forwarding to another system.

The Lambda function must be designed for batches of log events rather than assuming that each invocation contains exactly one log line. It should also handle retries and avoid producing duplicate side effects when processing is not inherently idempotent.

Transforming CloudWatch Logs Before Loading to Amazon S3

When logs must be transformed by Lambda and then stored in Amazon S3, Amazon Data Firehose provides a managed delivery pipeline:

CloudWatch Logs
        |
        v
Kinesis Data Firehose
        |
        v
Lambda transformation
        |
        v
Amazon S3

Firehose buffers records and delivers them to S3, reducing the need to build custom batching, buffering, and delivery logic. Lambda performs the transformation before delivery.

This architecture is different from directly invoking Lambda from a CloudWatch Logs subscription filter when the final destination is S3. Firehose is better suited to managed delivery, buffering, and batching into the destination.

CloudTrail Log Retention and Integrity Validation

AWS CloudTrail records AWS API activity. A trail can deliver events to an S3 bucket for long-term retention and centralized analysis.

For an audit requirement that includes tamper detection:

1. Configure a CloudTrail trail to deliver logs to an S3 bucket.
2. Enable log file integrity validation.
3. Restrict access to the destination bucket using IAM and bucket policies.
4. Apply an appropriate S3 retention strategy, such as lifecycle controls and, where required, immutable retention controls.

Log file integrity validation helps identify whether CloudTrail log files were modified or deleted after delivery. It does not by itself prevent every party with sufficient S3 permissions from changing objects, so preventive access controls and retention protections remain important.

If records must be retained for at least five years, the S3 design must support that period. Consider:

• S3 lifecycle and storage-class transitions
• Versioning where appropriate
• S3 Object Lock when regulatory immutability is required
• Restricted deletion permissions
• Separate security or audit ownership of the destination bucket

Organization-Wide CloudTrail Trails

An organization trail can capture API activity across the management account and member accounts in an AWS Organization. This avoids configuring and maintaining an independent trail in every account.

A key security property is that administrators in member accounts cannot modify or delete an organization trail. The organization’s management account, and potentially a delegated administrator depending on the operating model, retains control over the organization-level configuration.

A common centralized-audit design is:

AWS Organization
  |-- Management account
  |-- Member account A
  |-- Member account B
  |-- Member account C
          |
          v
Organization CloudTrail trail
          |
          v
Central S3 audit bucket

The S3 bucket policy must allow CloudTrail delivery while preventing unauthorized access or deletion by workload administrators.

Alerting on Root User API Activity

Root user activity is highly sensitive and should generally be rare. CloudTrail management events can be delivered to Amazon EventBridge, where a rule matches events associated with the root identity. The rule can target an Amazon SNS topic for notification.

The pattern is:

CloudTrail API event involving root
        |
        v
Amazon EventBridge event rule
        |
        v
Amazon SNS notification

The event pattern should identify the root identity rather than relying only on a specific API operation. This allows the alert to cover different root-user API calls.

The notification path should be tested and protected from accidental suppression. In high-assurance environments, notifications may also feed an incident-management or security-monitoring system.

AWS Config Auto Remediation for S3 Encryption

AWS Config evaluates resource configuration against rules. For S3 encryption compliance, a managed or custom Config rule can identify buckets that do not meet the organization’s encryption requirement.

An auto-remediation action can then invoke an approved remediation workflow to enable the required encryption configuration.

The general pattern is:

S3 bucket configuration
        |
        v
AWS Config rule
        |
        v
Noncompliant evaluation
        |
        v
Automatic remediation action

Important design considerations include:

• The remediation role needs only the permissions required to correct the configuration.
• Remediation should be tested against existing bucket behavior and application dependencies.
• Config evaluates configuration state; it is not primarily a preventive control for every future API request.
• Preventive controls, such as service control policies or permission boundaries, may be needed in addition to detection and remediation.

Exam-Relevant Takeaways

• Use the Unified CloudWatch Agent to collect EC2 operating-system logs and additional system metrics.
• For one-second metric periods, publish high-resolution custom metrics.
• Use a CloudWatch Logs subscription filter to invoke Lambda for near-real-time log processing.
• Use Kinesis Data Firehose with Lambda transformation when transformed records must be delivered and buffered into S3.
• Use CloudTrail with S3 delivery and log file integrity validation for auditable API logs and tamper detection.
• Use an organization trail to capture API activity across accounts and prevent member-account administrators from changing the trail.
• Use EventBridge plus SNS to notify on root-user API events.
• Use AWS Config rules and auto remediation to detect and correct noncompliant S3 encryption settings.
• A five-year retention requirement affects the S3 retention architecture, not merely the CloudTrail configuration.

Architecture Decision Guide

Requirement	Recommended service or pattern	Main reason
Collect application or system logs from EC2	Unified CloudWatch Agent to CloudWatch Logs	Agent-based collection from guest operating systems
Collect logs from on-premises servers	Unified CloudWatch Agent to CloudWatch Logs	Same centralized log-ingestion model can span environments
Publish metrics every second	High-resolution CloudWatch custom metrics	Supports sub-minute metric periods
Process CloudWatch log events in near real time with Lambda	CloudWatch Logs subscription filter to Lambda	Event-driven delivery of matching log events
Transform logs and deliver them to S3	Kinesis Data Firehose with Lambda transformation	Managed buffering, transformation, and S3 delivery
Record API activity for long-term audit	CloudTrail trail delivering to S3	Durable audit-log destination
Detect CloudTrail log tampering	CloudTrail log file integrity validation	Validates the integrity of delivered log files
Capture events across all organization accounts	CloudTrail organization trail	Centralized organization-level coverage and control
Alert when the root user performs API activity	CloudTrail events to EventBridge, then SNS	Event-driven detection and notification
Correct unencrypted S3 buckets	AWS Config rule with auto remediation	Detects noncompliance and invokes corrective action

Common Exam Traps

• Confusing standard and high-resolution metrics: A one-minute custom metric does not satisfy a one-second monitoring requirement.
• Using CloudTrail for operating-system logs: CloudTrail records AWS API activity; it does not collect arbitrary application or OS log files from EC2.
• Using CloudWatch Logs export as a real-time pipeline: Export mechanisms are not the same as subscription-based streaming.
• Choosing Lambda alone for durable S3 delivery: Firehose supplies buffering and managed delivery that a direct Lambda design would need to implement separately.
• Assuming log integrity validation prevents modification: Validation identifies integrity problems; S3 permissions and retention controls help prevent them.
• Assuming an organization trail prevents all changes by everyone: Member-account administrators cannot modify the organization trail, but central organization administrators retain control.
• Treating AWS Config as a preventive control: Config detects and can remediate state after evaluation. It does not replace preventive authorization controls.
• Ignoring retention mechanics: A five-year audit requirement may require S3 Object Lock, restricted deletion, versioning, and lifecycle planning—not just a five-year label on a policy.
• Matching only one root API call: Root-user alerting should identify the root identity so that different root API events are covered.

Real-World Engineer Notes

• Deploy the CloudWatch Agent configuration through immutable launch templates, Systems Manager, or another repeatable automation process. Manual installation will fail as Auto Scaling replaces instances.
• Separate operational logs from audit logs. Audit buckets should have stricter access controls, centralized ownership, and independent monitoring.
• Use least-privilege IAM roles for CloudWatch publishing, Firehose transformation, CloudTrail delivery, and Config remediation.
• Design Lambda log processors for retries, batching, malformed records, and duplicate delivery.
• Consider encryption in transit and at rest across CloudWatch Logs, Firehose, Lambda, and S3. Encryption is only one part of the broader audit-control design.
• Test root-user alerts and Config remediation in a nonproduction account before relying on them for incident response or compliance evidence.
• Centralized logging is more valuable when the destination account is separated from workload accounts and access is monitored independently.

Quick Reference Summary

• EC2/on-premises log collection: Unified CloudWatch Agent.
• One-second metrics: High-resolution CloudWatch custom metrics.
• CloudWatch Logs to Lambda: Subscription filter.
• Transform and deliver logs to S3: Kinesis Data Firehose with Lambda transformation.
• API auditing: AWS CloudTrail.
• Tamper detection for CloudTrail files: Log file integrity validation.
• Organization-wide audit coverage: CloudTrail organization trail.
• Root activity notification: EventBridge rule to SNS.
• S3 encryption compliance: AWS Config rule with auto remediation.
• Long-term immutable retention: S3 retention controls, potentially including Object Lock.

Flashcards

1. Which agent collects application and operating-system logs from EC2 instances?

The Unified CloudWatch Agent.

2. What CloudWatch metric type supports one-second granularity?

High-resolution custom metrics.

3. How can CloudWatch Logs invoke Lambda as log events arrive?

Configure a CloudWatch Logs subscription filter with Lambda as the destination.

4. Which service provides managed buffering and delivery of transformed records to S3?

Amazon Kinesis Data Firehose, optionally using Lambda for record transformation.

5. Which AWS service records AWS API activity?

AWS CloudTrail.

6. What CloudTrail feature helps detect modification of delivered log files?

Log file integrity validation.

7. How can API activity be captured across all accounts in an AWS Organization?

Use a CloudTrail organization trail.

8. Which service can match root-user CloudTrail events and route them to notifications?

Amazon EventBridge can match the events and route them to an SNS topic.

9. Which service evaluates whether S3 buckets meet an encryption requirement?

AWS Config.

10. What is required beyond detection when an unencrypted S3 bucket must be corrected automatically?

An AWS Config auto-remediation action with an appropriately permissioned remediation role.

Practice Questions

Question 1

A company operates hundreds of EC2 instances in an Auto Scaling group. It must collect application log files from every instance, including instances launched in the future, and centralize them in CloudWatch Logs. Which solution meets the requirement with the least operational overhead?

A. Configure each current instance manually to upload logs to S3.
B. Install and configure the Unified CloudWatch Agent through the launch template or instance bootstrap process.
C. Enable CloudTrail data events for the EC2 instances.
D. Configure VPC Flow Logs to capture application log files.

Correct answer: B

The Unified CloudWatch Agent collects guest operating-system log files. Putting its installation and configuration into the instance provisioning process ensures that newly launched Auto Scaling instances are configured automatically. CloudTrail and VPC Flow Logs do not collect arbitrary application log files.

Question 2

An application publishes a custom performance metric. Operations requires alarms based on one-second metric periods. Which solution should an architect recommend?

A. Publish a standard CloudWatch custom metric and configure a one-second alarm period.
B. Publish a high-resolution custom metric.
C. Use CloudTrail management events with a one-second lookup interval.
D. Store the metric in S3 and query it with Athena every second.

Correct answer: B

One-second periods require high-resolution custom metrics. A standard-resolution metric cannot provide the required one-second granularity merely by changing the alarm configuration.

Question 3

A security team requires CloudTrail records from all accounts in an AWS Organization. Administrators in member accounts must not be able to stop, modify, or delete the central trail. Which architecture meets the requirement?

A. Create an independent trail in every member account and give account administrators full trail permissions.
B. Create an organization trail controlled centrally by the organization’s management account.
C. Send CloudWatch Logs from each account to a shared Lambda function.
D. Use AWS Config to record CloudTrail API activity.

Correct answer: B

An organization trail provides centralized CloudTrail coverage across the organization and prevents member-account administrators from modifying or deleting the organization trail. Config is not a replacement for CloudTrail API auditing.

Question 4

A compliance team requires all S3 buckets to use encryption. Noncompliant buckets must be identified and automatically corrected. Which design is most appropriate?

A. Use CloudTrail to detect unencrypted buckets and send an SNS alert only.
B. Use AWS Config to evaluate bucket encryption and invoke an auto-remediation action for noncompliant resources.
C. Use VPC Flow Logs to detect unencrypted S3 traffic.
D. Use CloudWatch high-resolution metrics to monitor bucket encryption.

Correct answer: B

AWS Config evaluates resource configuration and supports remediation workflows. CloudTrail can record API activity but does not by itself continuously evaluate and correct S3 configuration compliance.

Question 5

An organization must transform CloudWatch log records with Lambda and deliver the transformed output to S3 while minimizing custom buffering code. Which architecture should be selected?

A. CloudWatch Logs subscription filter directly to S3.
B. Kinesis Data Firehose with Lambda transformation and S3 as the destination.
C. CloudTrail directly to Lambda and then to EBS.
D. EventBridge to SNS and then to S3.

Correct answer: B

Kinesis Data Firehose provides managed buffering and delivery to S3 and can invoke Lambda for record transformation. The other options do not provide the required end-to-end log transformation and managed S3 delivery pattern.