How should the Security Engineer do this?
Log in to each account four times a day and filter the AWS CloudTrail log data, then copy and paste the logs in to the Amazon S3 bucket in the destination account.
Set up Amazon CloudWatch to stream data to an Amazon S3 bucket in each source account. Set up bucket replication for each source account into a centralized bucket owned by the Security Engineer.
Set up an AWS Config aggregator to collect AWS configuration data from multiple sources.
Set up Amazon CloudWatch cross-account log data sharing with subscriptions in each account. Send the logs to Amazon Kinesis Data Firehose in the Security Engineer’s account.
Explanations:
Manually logging in to each account multiple times a day to filter and copy logs is inefficient, prone to human error, and does not provide near-real-time analysis capabilities. Automation is necessary for effective log aggregation.
While setting up Amazon CloudWatch to stream data to S3 and using bucket replication could centralize data, it doesn’t directly address log aggregation from AWS services, which is typically handled by CloudTrail for security logs. This method would not ensure real-time log collection.
AWS Config is primarily used for tracking configuration changes and compliance over time, not for aggregating logs. It does not provide the near-real-time logging capability required for security analysis and does not aggregate logs across accounts effectively.
Setting up Amazon CloudWatch cross-account log data sharing allows centralized log collection from multiple AWS accounts. Using subscriptions to send logs to Amazon Kinesis Data Firehose enables near-real-time analysis and processing of log data, making this the most effective solution for log aggregation.
I systematize that the answer is:
Set up Amazon CloudWatch cross-account log data sharing with subscriptions in each account. Send the logs to Amazon Kinesis Data Firehose in the Security Engineer’s account.