Question

A financial services company runs a public-facing application behind an Application Load Balancer protected by AWS WAF. The security team, operating in a separate central logging account, must receive WAF logs in near-real-time for automated threat analysis, and compliance requires that the full request logs (including matched rule details) never traverse the public internet and remain encrypted at rest. Which logging configuration meets these requirements?

Accepted Answer

Enable WAF logging to an Amazon Kinesis Data Firehose delivery stream that writes to an S3 bucket in the central logging account, using a cross-account bucket policy and SSE-KMS with a customer managed key shared to the application account.

Answer

Enable WAF logging directly to an S3 bucket in the application account and use S3 Cross-Region Replication to copy objects to the central logging account bucket over the public internet.

Answer

Enable WAF logging to CloudWatch Logs in the application account and create a subscription filter that streams the log group over a public NAT gateway to the central account.

Answer

Enable VPC Flow Logs on the ALB subnets and deliver them to the central logging account, since Flow Logs capture the same Layer 7 rule-match data as WAF logs.