A county security office wants VPC Flow Logs and AWS CloudTrail delivered into a dedicated central log-archive account where investigators can read history but application teams cannot alter or delete the archives. Which approach best designs that secure logging architecture?
Select an answer to reveal the explanation.
Short Explanation
Think of the central archive like a sealed evidence locker with a narrow keyhole. Flow Logs and CloudTrail land in one locked account; investigators can review, but app teams cannot rewrite the past. Local disks and chat webhooks are not an immutable county archive.
Full Explanation
County investigators need an evidence-grade logging architecture: VPC Flow Logs and AWS CloudTrail must land in a dedicated central archive account where history is readable under controlled roles but application teams cannot alter or delete what they produced. The durable pattern is cross-account delivery into a locked S3 bucket or centralized log groups, then resource policies and SCPs that deny unauthorized s3:DeleteObject, bucket policy overrides, and trail stop/delete actions while granting investigators Get/List (and optionally decrypt) only. Separation of duties is the point—producers write, archivists retain, responders read.
Keeping Flow Logs only on originating EC2 local disks fails durability and integrity: instance compromise or recycle destroys the evidence, and screenshots emailed weekly are not continuous, searchable, or tamper-evident archives. Disabling CloudTrail to save cost and parking Flow Logs in a publicly writable bucket fails both detection coverage and confidentiality; public write invites log poisoning. Publishing Flow Logs to a Slack webhook and deleting originals fails retention and chain-of-custody: chat is not an immutable audit store, and deleting source logs removes the forensic baseline auditors expect.
Exam caveat: centralization alone is insufficient if the archive bucket still allows the producing account broad s3:*; encode deny-delete and deny-public in the archive policy. Operational check: generate a known VPC flow and an API call, confirm both objects appear only in the archive account, attempt delete from an application role (must fail), and verify investigator roles can retrieve history without write access.