What's changed: Deepened SCS-C02 Chapter 2 (added comparison tables, scenarios, FAQs, exam traps, deep-dive paragraphs to each section; localized figures to Japanese)
2.3Log Analysis and Centralization
Understand using logs—CloudWatch Logs Insights, Athena (S3 logs), OpenSearch, centralized logging (cross-account), and retention/lifecycle. Gain insight from large log volumes.
Logs deliver value only when analyzed. Choose among Logs Insights, Athena, and OpenSearch by purpose.
2.3.1Means of log analysis
- Logs Insights: analyze CloudWatch Logs with SQL-like queries.
- Athena: serverless SQL queries over large logs in S3 (CloudTrail/VPC Flow Logs).
- OpenSearch: real-time full-text search/visualization (dashboards).
- Centralized logging: forward to a central log account via subscription filters → Firehose; manage retention by lifecycle.
Common on SCS-C02: query CloudWatch Logs = Logs Insights, SQL analysis of CloudTrail/Flow Logs in S3 = Athena, full-text search/visualization = OpenSearch, org-wide centralized logging = subscription filters → Firehose → central account. Analyzing audit logs in S3 is typically done with Athena.
SCS-C02 log utilization probes "choosing the analysis tool by storage location and purpose." CloudWatch Logs Insights offers SQL-like queries over CloudWatch Logs, good for ad-hoc investigation of app/OS logs. Athena queries large audit logs accumulated in S3 (CloudTrail/VPC Flow Logs/ELB/CloudFront) serverlessly with SQL (define tables with the Glue Data Catalog; optimize cost/performance with Parquet conversion and partitioning)—the standard for security investigation and compliance reporting. OpenSearch Service suits real-time full-text search and dashboard visualization for SIEM-like use (requires OCU/index management). For org-wide centralized logging, stream from each account’s CloudWatch Logs via subscription filters to Kinesis Data Firehose (or Data Streams), aggregating to S3/OpenSearch in a central log account; CloudTrail can aggregate to central S3 from the start via an organization trail. Manage retention with lifecycle policies, transitioning long-term to Glacier to curb cost for rarely analyzed old logs. External SIEM (Splunk, etc.) integration is possible via Firehose. The key is to choose "Logs Insights for CW Logs, Athena for S3, OpenSearch for full-text/visualization" and aggregate to a central account via subscription filters + Firehose.
| Log location/purpose | Tool | Key point |
|---|---|---|
| Ad-hoc on CloudWatch Logs | Logs Insights | SQL-like; app/OS logs |
| Large audit logs in S3 | Athena | Serverless SQL; CloudTrail/Flow Logs; Parquet/partitions |
| Full-text search/visualization | OpenSearch | Real-time; SIEM-like; dashboards |
| Org-wide centralization | Subscription filters → Firehose | To central log account; lifecycle retention |
Scenario: An investigation requires "find all AccessDenied by a specific IAM role in the last 6 months of CloudTrail." Logs are already in S3. → Use Athena to define a table over the S3 CloudTrail logs (Glue catalog) and extract with a SQL query filtering where errorCode is AccessDenied and the userIdentity arn matches the target role. Optimize cost/speed with date partitions and Parquet conversion. For real-time dashboards use OpenSearch; for ad-hoc on CloudWatch Logs use Logs Insights.
FAQ: Can Logs Insights analyze CloudTrail logs in S3? No. Logs Insights is only for CloudWatch Logs. To SQL-analyze CloudTrail/VPC Flow Logs delivered to S3, use Athena (serverless, schema via Glue catalog). For real-time full-text search/dashboards, use OpenSearch. The analysis tool is determined by "where the logs are (CW Logs vs S3)."
Exam trap: Choosing Logs Insights to analyze CloudTrail logs accumulated in S3 is wrong (Logs Insights is CloudWatch Logs only)—use Athena for S3 logs. Also, "aggregate all-account logs" by manual copy is fragile—automate with subscription filters → Firehose → central account (CloudTrail via organization trail). For cost, transition old logs to Glacier via lifecycle.
2.3.2Section summary
- Analysis = Logs Insights (CW)/Athena (S3)/OpenSearch (search)
- Centralize = subscription filters → Firehose → central account
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Query large CloudTrail logs in S3 serverlessly with SQL for investigation. What?
Q2. Analyze CloudWatch Logs fast with SQL-like queries. What?
Q3. Forward multi-account logs in real time to a central log account. What?