A county security office wants VPC Flow Logs and AWS CloudTrail del…

Question

A county security office wants VPC Flow Logs and AWS CloudTrail delivered into a dedicated central log-archive account where investigators can read history but application teams cannot alter or delete the archives. Which approach best designs that secure logging architecture?

Accepted Answer

Send Flow Logs and CloudTrail to a central archive account with restricted bucket or log-group policies that deny unauthorized delete/alter while allowing controlled investigator read access — Think of the central archive like a sealed evidence locker with a narrow keyhole. Flow Logs and CloudTrail land in one locked account; investigators can review, but app teams cannot rewrite the past. Local disks and chat webhooks are not an immutable county archive.

Answer

Store all Flow Logs only on the originating EC2 instance local disks and email weekly screenshots to auditors

Answer

Disable CloudTrail in every account to reduce cost and keep Flow Logs in a publicly writable bucket for convenience

Answer

Publish Flow Logs to a Slack webhook and delete the original logs immediately after each chat message

A county security office wants VPC Flow Logs and AWS CloudTrail delivered into a dedicated central log-archive account where investigators can read history but application teams cannot alter or delete the archives. Which approach best designs that secure logging architecture?

Short Explanation

Full Explanation