Question

A financial services company runs a critical application on EC2 that writes structured application logs to Amazon CloudWatch Logs. The incident response team wants near-real-time detection: whenever a log entry contains the string "AuthorizationFailure" more than a threshold number of times within a short window, an automated containment workflow must be triggered within seconds. The solution must not rely on polling and must scale to high log volume without dropping events. Which approach best meets these requirements?

Accepted Answer

Create a CloudWatch Logs metric filter matching "AuthorizationFailure", publish it to a custom metric, and create a CloudWatch alarm that triggers an SNS topic invoking the containment Lambda when the threshold is breached.

Answer

Schedule a Lambda function every minute via EventBridge to call FilterLogEvents on the log group and count matches, invoking the containment workflow when the count exceeds the threshold.

Answer

Enable CloudTrail data events for CloudWatch Logs and create an EventBridge rule that matches the log content to invoke the containment Lambda.

Answer

Configure a CloudWatch Logs subscription filter that streams every log event to the containment Lambda directly, letting the Lambda evaluate the threshold on each invocation.