Question

A security team operates a centralized logging account. They need application VPC Flow Logs and CloudWatch Logs from 40 member accounts to be continuously streamed in near real time to a central Amazon OpenSearch Service domain in the logging account for correlation and dashboards. The solution must scale to high log volume, require minimal per-account maintenance, and avoid custom polling code. Which approach best meets these requirements?

Accepted Answer

In each member account, create a CloudWatch Logs subscription filter that sends log events to a cross-account Amazon Kinesis Data Firehose delivery stream (via a destination in the logging account) configured to deliver to the central OpenSearch domain.

Answer

Schedule a Lambda function in each member account to call GetLogEvents every minute and PutRecord the results into an S3 bucket in the logging account, then load them into OpenSearch nightly.

Answer

Enable CloudWatch Logs export tasks in every member account to export log groups to the central S3 bucket on a recurring basis, then index the objects with an OpenSearch ingestion pipeline.

Answer

Configure AWS Config aggregators in the logging account to collect the log data from all member accounts and forward it to OpenSearch through EventBridge.