Introduction
A quick note about AWS CloudTrail Solution Architect Use Cases. This post is a quick note from the course Ultimate AWS Certified Solutions Architect Professional by Stephane Maarek. The only purpose of this post is a summary, if you want detailed learning, please buy a course by Stephane Maarek.
CloudTrail Solution Architect - Delivery to S3
The first use case for the Solution Architect example. CloudTrail delivers log files to an S3 bucket.
You can deliver copies of events to Amazon S3 every five minutes. By default, Amazon S3 buckets and objects are private, you need to modify an Amazon S3 bucket to receive log files for an organization trail.
Log files sent from CloudTrail will be encryption, SSE-S3 by default, but you can set up manually SSE-KMS.
To optimize and save your costs, you could set up a lifecycle policy on your S3 bucket to transition objects to the S3 Glacier.
If you need notification when an S3 bucket receives an object, you can enable S3 events to notify either an SQS, SNS or Lambda function.
You can also have CloudTrail deliver notifications directly to SNS, and from SNS you could invoke SQS or Lambda.
AWS provides you with different methods based on the case.
CloudTrail Solution Architect - Multi Account, Multi Region Logging
The second use case for the Solution Architect example. Cross Account Monitor Architect.
In the above image, we have two accounts, account A and account B, and we have a security account that we need to send logs into it.
In the two accounts, we have CloudTrail, and we’ll set up an S3 bucket in the security account that hold the logs of all these CloudTrail.
And the only way for us to deliver log files into an S3 bucket in the security account is to define an S3 bucket policy, and that S3 bucket policy should allow CloudTrail to deliver files into S3.
Alert for API calls
The third use case for the Solution Architect example. Alert for certain API calls is done.
From CloudTrail you can stream all these events into CloudWtach Logs, and from CloudWatch Logs, you can open up a bunch of use cases.
With the above image, after CloudWatch Logs receive log files from CloudTrail, you can create a metric filter and alarms to monitor the events in the log files.
For example, you can specify an event such as the Amazon EC2 RunInstances operation and CloudWatch will send you notifications to SNS when that event occurs, and from SNS you could invoke SQS or Lambda.
CloudTrail: How to react to events the fastest?
Overall, CloudTrail may take up to 15 minutes to deliver events, but you can combine CloudTrail with other tools to react to events faster.
The first and fastest, most reactive way is using CloudWatch Events, which can be triggered for any API call in CloudTrail and you can set up by creating a trail.
The second way is using CloudTrail delivery to CloudWatch Logs, the events are streamed.
The third way is using CloudTrail delivery to S3, the events are delivered every five minutes.
You can have different solutions, either CloudWatch Events, CloudWatch Logs, or S3, and none of them is bad or great, it just depends on what you are trying to achieve.
End
End quick note about AWS CloudTrail Solution Architect use cases.