Question

A financial services company runs a centralized inspection VPC using AWS Network Firewall to enforce egress controls for all workload accounts. The compliance team requires that (1) all flow and alert logs from the firewall be retained immutably for 7 years, (2) logs be encrypted with a customer-managed key that the security team fully controls, and (3) the security team be able to prove during audits that logging was never disabled. Which combination of configurations BEST meets these requirements?

Accepted Answer

Configure Network Firewall logging to an S3 bucket with Object Lock in compliance mode, encrypt the bucket with an SSE-KMS customer-managed key, and use AWS Config with a managed rule to detect and alert when firewall logging configuration changes.

Answer

Configure Network Firewall logging to a CloudWatch Logs group with a 7-year retention setting, encrypt the log group with an AWS-managed key, and enable CloudTrail data events on the log group.

Answer

Configure Network Firewall logging to Kinesis Data Firehose delivering to S3 with versioning enabled, encrypt with SSE-S3, and rely on S3 lifecycle policies to prevent deletion for 7 years.

Answer

Configure Network Firewall logging to an S3 bucket with a bucket policy denying deletes, encrypt with an SSE-KMS customer-managed key, and enable GuardDuty to monitor for logging changes.