Question

A financial services company must retain AWS WAF web ACL logs for a compliance audit. Requirements state that all WAF traffic logs must be captured, encrypted at rest with a customer-managed KMS key, and delivered to a central logging account's S3 bucket. The security team enables WAF logging directly to an Amazon S3 bucket in the same account, but the auditor rejects the setup because logs are not encrypted with the company's customer-managed key and are not centralized. Which configuration meets all requirements?

Accepted Answer

Configure WAF logging to an Amazon Kinesis Data Firehose delivery stream that uses a customer-managed KMS key for server-side encryption and delivers to the central account's cross-account S3 bucket.

Answer

Enable WAF logging to a CloudWatch Logs log group encrypted with an AWS-managed key, then use a subscription filter to forward logs to the central account.

Answer

Enable WAF logging directly to the central account's S3 bucket and rely on S3 default SSE-S3 encryption to satisfy the customer-managed key requirement.

Answer

Configure WAF logging to a local S3 bucket with SSE-KMS, then enable S3 cross-region replication to copy the logs into the central logging account bucket.