Question

A company runs dozens of microservices across multiple AWS accounts, each writing application logs to its own CloudWatch Logs log groups. The security team wants all log events that match a specific pattern (for example, lines containing "UnauthorizedAccess") to be delivered in near real time to a centralized Amazon Kinesis Data Streams stream in a dedicated logging account for correlation and analysis. Which approach meets this requirement with the least custom code and lowest operational overhead?

Accepted Answer

Create a CloudWatch Logs subscription filter on each source log group that matches the pattern and forwards matching events to the cross-account Kinesis Data Streams destination.

Answer

Configure a metric filter on each log group and create a CloudWatch alarm that publishes matching log lines to the centralized Kinesis Data Streams stream.

Answer

Schedule a Lambda function every minute to call FilterLogEvents on each log group and use PutRecord to write matching events into the Kinesis Data Streams stream.

Answer

Enable CloudWatch Logs export tasks on each log group to periodically export matching logs to an S3 bucket, then trigger a Lambda to load them into Kinesis Data Streams.