AWS Certified Solutions Architect Professional – Security – CloudTrail Solution Architect Use Cases

Introduction A quick note about AWS CloudTrail Solution Architect Use Cases. This post is a quick note from the course Ultimate AWS Certified Solutions Architect Professional by Stephane Maarek. The only purpose of this post is a summary, if you want detailed learning, please buy a course by Stephane Maarek. CloudTrail Solution Architect – Delivery

Introduction

A quick note about AWS CloudTrail Solution Architect Use Cases. This post is a quick note from the course Ultimate AWS Certified Solutions Architect Professional by Stephane Maarek. The only purpose of this post is a summary, if you want detailed learning, please buy a course by Stephane Maarek.

CloudTrail Solution Architect – Delivery to S3

The first use case for the Solution Architect example. CloudTrail delivers log files to an S3 bucket.

image.png

You can deliver copies of events to Amazon S3 every five minutes. By default, Amazon S3 buckets and objects are private, you need to modify an Amazon S3 bucket to receive log files for an organization trail.

Log files sent from CloudTrail will be encryption, SSE-S3 by default, but you can set up manually SSE-KMS.

To optimize and save your costs, you could set up a lifecycle policy on your S3 bucket to transition objects to the S3 Glacier.

If you need notification when an S3 bucket receives an object, you can enable S3 events to notify either an SQS, SNS or Lambda function.

You can also have CloudTrail deliver notifications directly to SNS, and from SNS you could invoke SQS or Lambda.

AWS provides you with different methods based on the case.

CloudTrail Solution Architect – Multi Account, Multi Region Logging

The second use case for the Solution Architect example. Cross Account Monitor Architect.

image.png

In the above image, we have two accounts, account A and account B, and we have a security account that we need to send logs into it.

In the two accounts, we have CloudTrail, and we’ll set up an S3 bucket in the security account that hold the logs of all these CloudTrail.

And the only way for us to deliver log files into an S3 bucket in the security account is to define an S3 bucket policy, and that S3 bucket policy should allow CloudTrail to deliver files into S3.

Alert for API calls

The third use case for the Solution Architect example. Alert for certain API calls is done.

image.png

From CloudTrail you can stream all these events into CloudWtach Logs, and from CloudWatch Logs, you can open up a bunch of use cases.

With the above image, after CloudWatch Logs receive log files from CloudTrail, you can create a metric filter and alarms to monitor the events in the log files.

For example, you can specify an event such as the Amazon EC2 RunInstances operation and CloudWatch will send you notifications to SNS when that event occurs, and from SNS you could invoke SQS or Lambda.

CloudTrail: How to react to events the fastest?

Overall, CloudTrail may take up to 15 minutes to deliver events, but you can combine CloudTrail with other tools to react to events faster.

The first and fastest, most reactive way is using CloudWatch Events, which can be triggered for any API call in CloudTrail and you can set up by creating a trail.

The second way is using CloudTrail delivery to CloudWatch Logs, the events are streamed.

The third way is using CloudTrail delivery to S3, the events are delivered every five minutes.

You can have different solutions, either CloudWatch Events, CloudWatch Logs, or S3, and none of them is bad or great, it just depends on what you are trying to achieve.

End

End quick note about AWS CloudTrail Solution Architect use cases.

Nguồn: viblo.asia

Bài viết liên quan

WebP là gì? Hướng dẫn cách để chuyển hình ảnh jpg, png qua webp

WebP là gì? WebP là một định dạng ảnh hiện đại, được phát triển bởi Google

Điểm khác biệt giữa IPv4 và IPv6 là gì?

IPv4 và IPv6 là hai phiên bản của hệ thống địa chỉ Giao thức Internet (IP). IP l

Check nameservers của tên miền xem website trỏ đúng chưa

Tìm hiểu cách check nameservers của tên miền để xác định tên miền đó đang dùn

Mình đang dùng Google Domains để check tên miền hàng ngày

Từ khi thông báo dịch vụ Google Domains bỏ mác Beta, mình mới để ý và bắt đầ