Question

A SysOps administrator manages a fleet of application servers that send logs to a CloudWatch Logs log group. The security team wants to be notified within minutes whenever the string "UnauthorizedAccess" appears in the application logs. The solution must require minimal ongoing maintenance and use native AWS monitoring services. What is the MOST appropriate way to implement this notification?

Accepted Answer

Create a CloudWatch Logs metric filter that matches "UnauthorizedAccess", publish it to a custom metric, and create a CloudWatch alarm on that metric that notifies an SNS topic.

Answer

Create a CloudWatch Logs subscription filter that streams all log events to an SNS topic subscribed by the security team.

Answer

Enable CloudWatch anomaly detection on the log group so it automatically alerts when the "UnauthorizedAccess" pattern deviates from normal.

Answer

Schedule a Lambda function every 5 minutes to run a CloudWatch Logs Insights query for "UnauthorizedAccess" and email the results using SES.