Which solution will meet this requirement in the MOST operationally efficient manner?
Implement AWS Config. Configure an AWS Config managed rule to detect changes to security groups. Configure a manual remediation action for noncompliant resources to forward evaluations to an Amazon Simple Notification Service (Amazon SNS) topic.
Implement AWS Config. Configure an AWS Config managed rule to detect changes to security groups. Configure a manual remediation action for noncompliant resources to forward evaluations to an Amazon Simple Queue Service (Amazon SQS) queue.
Implement AWS CloudTrail. Configure forwarding to Amazon CloudWatch Logs. Configure a CloudWatch Logs metric filter with a pattern match on all security group changes. Configure an Amazon CloudWatch alarm to publish messages to an Amazon Simple Notification Service (Amazon SNS) topic.
Implement AWS CloudTrail. Configure forwarding to Amazon S3. Configure an AWS Glue crawler for use with Amazon Athena to query log contents for event patterns that indicate changes to security groups. Publish the query results to an Amazon Simple Queue Service (Amazon SQS) queue.
Explanations:
AWS Config can detect changes to security groups, but manual remediation actions with SNS for alerts are less efficient than using CloudTrail and CloudWatch.
AWS Config detects changes, but sending alerts through an SQS queue requires additional complexity, making it less operationally efficient.
CloudTrail can capture security group changes and forward them to CloudWatch Logs, which can trigger SNS alerts through CloudWatch alarms, making this the most operationally efficient solution.
While CloudTrail forwards logs to S3, using Athena and SQS adds unnecessary complexity compared to CloudWatch and SNS for real-time alerting.
I would say the answer is:
Implement AWS CloudTrail. Configure forwarding to Amazon CloudWatch Logs. Configure a CloudWatch Logs metric filter with a pattern match on all security group changes. Configure an Amazon CloudWatch alarm to publish messages to an Amazon Simple Notification Service (Amazon SNS) topic.
From what I’ve heard, the answer is:
Implement AWS CloudTrail. Configure forwarding to Amazon CloudWatch Logs. Configure a CloudWatch Logs metric filter with a pattern match on all security group changes. Configure an Amazon CloudWatch alarm to publish messages to an Amazon Simple Notification Service (Amazon SNS) topic.