Which solution meets these requirements?
Configure a Multi-AZ Auto Scaling group using the application’s AMI. Create an Application Load Balancer (ALB) and select the previously created Auto Scaling group as the target. Use Amazon Inspector to monitor traffic to the ALB and EC2 instances. Create a web ACL in WAF. Create an AWS WAF using the web ACL and ALB. Use an AWS Lambda function to frequently push the Amazon Inspector report to the third-party auditing application.
Configure an Application Load Balancer (ALB) and add the EC2 instances as targets. Create a web ACL in WAF. Create an AWS WAF using the web ACL and ALB name and enable logging with Amazon CloudWatch Logs. Use an AWS Lambda function to frequently push the logs to the third-party auditing application.
Configure an Application Load Balancer (ALB) along with a target group adding the EC2 instances as targets. Create an Amazon Kinesis Data Firehose with the destination of the third-party auditing application. Create a web ACL in WAF. Create an AWS WAF using the web ACL and ALB then enable logging by selecting the Kinesis Data Firehose as the destination. Subscribe to AWS Managed Rules in AWS Marketplace, choosing the WAF as the subscriber.
Configure a Multi-AZ Auto Scaling group using the application’s AMI. Create an Application Load Balancer (ALB) and select the previously created Auto Scaling group as the target. Create an Amazon Kinesis Data Firehose with a destination of the third-party auditing application. Create a web ACL in WAF. Create an AWS WAF using the WebACL and ALB then enable logging by selecting the Kinesis Data Firehose as the destination. Subscribe to AWS Managed Rules in AWS Marketplace, choosing the WAF as the subscriber.
Explanations:
While this option includes an Auto Scaling group and WAF for traffic filtering, it uses Amazon Inspector for monitoring, which is not specifically designed for real-time traffic filtering. Additionally, pushing reports to a third-party application does not ensure that rejected requests are logged in real-time.
This option implements an ALB and WAF with logging enabled. However, it does not address the requirement for high availability since it lacks an Auto Scaling group and redundancy across Availability Zones. Also, it does not utilize a specific method to send rejected requests to the third-party auditing application.
This option creates an ALB and WAF, but does not implement high availability with an Auto Scaling group. While it does allow logging to Kinesis Data Firehose, which can send logs to the third-party application, it does not directly capture rejected requests in a real-time manner.
This option meets all requirements by using a Multi-AZ Auto Scaling group for high availability, an ALB for traffic distribution, a WAF for filtering attacks, and Kinesis Data Firehose to send logs to the third-party auditing application. It also allows for subscription to AWS Managed Rules for enhanced security, thus addressing all concerns.
As I understand it, the answer is:
Configure a Multi-AZ Auto Scaling group using the application’s AMI. Create an Application Load Balancer (ALB) and select the previously created Auto Scaling group as the target. Create an Amazon Kinesis Data Firehose with a destination of the third-party auditing application. Create a web ACL in WAF. Create an AWS WAF using the WebACL and ALB then enable logging by selecting the Kinesis Data Firehose as the destination. Subscribe to AWS Managed Rules in AWS Marketplace, choosing the WAF as the subscriber.