Capabilities and use cases of AWS services that provide data sources (for example, log level, type, verbosity, cadence, timeliness, immutability)

What AWS service would you use to centrally collect and monitor log data across multiple AWS accounts and regions, and how can you ensure the logs are immutable?

AWS CloudTrail is the service that collects API call and related events across multiple AWS accounts and regions. To ensure the logs are immutable, you would enable CloudTrail log file integrity validation, where a hash for every log file written is delivered to an S3 bucket. Additionally, the use of S3 Object Lock with the CloudTrail S3 bucket can enforce immutability.

Describe how Amazon S3 server access logging can be configured for auditing purposes and mention the type of data it captures.

Amazon S3 server access logging can be enabled on a bucket-by-bucket basis through the S3 console, AWS CLI, or an API. It captures details about each access request, such as requester information, bucket name, request time, action taken, and error code if the action was unsuccessful. This can be used for security and access audits.

Can you monitor real-time database activity in AWS, and which service would you use for this? What data would this activity provide?

Yes, you can monitor real-time database activity using Amazon RDS Performance Insights. This service provides a real-time dashboard of database load by SQL query, wait event, host, or user. It provides data such as database load, average active sessions, and top SQL queries, helping you quickly assess performance issues.

In AWS, what service would you use for collecting application and resource logs, and how would you configure the verbosity of these logs?

You would use Amazon CloudWatch Logs for collecting application and resource logs. You can configure the verbosity by setting the appropriate level of detail in the application or resource’s logging configuration before sending it to CloudWatch Logs. An AWS SDK or the CloudWatch Logs Agent can help with this task.

How does AWS Kinesis Data Firehose ensure the immutability of log data, and what type of data sources can it handle?

AWS Kinesis Data Firehose does not intrinsically ensure immutability but facilitates it by delivering streaming data directly to S3, where it can be protected by using versioning or Object Lock. It handles data sources like streaming event logs, clickstreams, IoT telemetry data, and more.

What is the role of AWS IAM in defining the cadence with which AWS services can write data to logs or data stores?

AWS IAM doesn’t directly govern the cadence of data writing; it controls access and permissions for AWS services and users to perform data writing operations. By setting the right permissions, you can ensure that only authorized services or users can write data at the designated times and intervals.

Discuss how AWS Lambda can be used to react to log data changes and what use cases this would be suitable for.

AWS Lambda can be triggered by events such as S3 bucket updates when new log data is uploaded or CloudWatch Logs pattern detections. It can be used for use cases such as real-time data processing, file processing, or executing automated responses to specific log entries, like security alerts.

Explain the process of configuring log file validation in AWS CloudTrail and the purpose behind it.

To configure log file validation, you turn it on when you create a new trail or update an existing one. AWS CloudTrail then creates a hash for each log file and delivers a hashed and signed digest file to an S3 bucket. This provides proof that the files have not changed after delivery to the S3 bucket.

Describe the term “verbosity” in the context of AWS log files and how it can impact security monitoring.

“Verbosity” refers to the amount of detail contained within log files. In AWS, adjusting the verbosity affects the granularity of the data recorded. Higher verbosity can improve security monitoring by providing more detailed data about operations and potential security incidents, but may also increase storage costs and complexity of log analysis.

How would you leverage AWS Config to record software configuration changes over time, and what security insights can this provide?

AWS Config continuously monitors and records AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired baselines. It provides insights into compliance with security policies, helping to flag unauthorized or insecure changes and facilitating an audit trail for change management.

What is the difference between AWS CloudWatch Logs and CloudTrail, and how do they complement each other in a security context?

AWS CloudWatch Logs primarily focuses on the collection and analysis of application and system log files, while CloudTrail focuses on recording API calls and related events within AWS accounts. Together, they provide a comprehensive monitoring solution, where CloudWatch can be used for real-time operational issues, and CloudTrail can be used for audit trails and compliance.

Discuss the importance of ‘timeliness’ in AWS CloudTrail and how it can affect security incident response.

‘Timeliness’ refers to how quickly log data becomes available for analysis after an API call is made. In CloudTrail, logs typically become available within 15 minutes of the API call. Timeliness is crucial for security incident response as it can significantly impact the ability to detect and respond to potential threats in a speedy fashion, potentially reducing the damage caused by security incidents.