Question

A security team wants application logs from a CloudWatch Logs log group delivered continuously to an S3 bucket in near real time so that a downstream SIEM can pull and parse them within seconds of generation. They also want the ability to transform each record (adding a source field) before it lands in S3, without managing servers. Which approach meets these requirements?

Accepted Answer

Create a CloudWatch Logs subscription filter that streams the log group to an Amazon Data Firehose delivery stream, with a Lambda transform function, delivering to the S3 bucket.

Answer

Configure a CloudWatch Logs export task scheduled every 5 minutes to export the log group data to the S3 bucket.

Answer

Enable a CloudWatch Logs metric filter on the log group and configure the metric alarm action to publish the log data to the S3 bucket.

Answer

Create an EventBridge rule matching the log group events and target the S3 bucket directly to store each log event.