Question

A financial services company has an existing multi-account AWS environment managed under AWS Organizations. The security team currently exports CloudTrail logs from each account into per-account S3 buckets and manually runs Amazon Athena queries whenever they investigate a suspicious API activity. Investigations frequently span multiple accounts and take days because analysts must manually correlate results across dozens of buckets and re-create Athena tables. Leadership wants to improve the security posture by reducing investigation time and enabling ongoing detection of anomalous API behavior with minimal operational overhead. Which approach BEST meets these requirements?

Accepted Answer

Enable Amazon GuardDuty at the organization level using the delegated administrator, and create an organization-wide CloudTrail Lake event data store to run SQL-based queries across all accounts from a single location.

Answer

Create an organization CloudTrail that delivers events to a centralized S3 bucket, then schedule an AWS Lambda function to periodically scan the bucket and email analysts when it finds unusual event names.

Answer

Consolidate all per-account CloudTrail S3 buckets into one bucket using S3 Replication and continue running manual Athena queries against the consolidated data with pre-built table partitions.

Answer

Deploy Amazon OpenSearch Service in the security account, stream CloudTrail logs from every account via Kinesis Data Firehose, and build custom anomaly detection dashboards that analysts maintain.