Logs 2

Question 1

Subscription Filters

What is a Subscription Filter?

Answer 1

Set per Log Group, set filter criteria, destination

Question 2

Subscription Filters

Can you subscribe a destination to a Subscription Filter cross-account?

Answer 2

Yes for OpenSearch & Kinesis, no for Lambda

Question 3

Subscription Filters

Is delivery to Kinesis real-time?

important

Answer 3

Yes, other than Kinesis Data Streams, which has it’s own internal delay.

Question 4

Subscription Filters

Is delivery to Lambda real-time?

important

Answer 4

Yes

Question 5

Subscription Filters

Best Practice for cross-account log aggregation?

Answer 5

All accounts use Subscription Filter to common Kinesis Data Stream, which loads into a warehouse

Question 6

Log Security

How can applications redact certain things in CWL?

Answer 6

Data Protection Policy

Question 7

Log Security

Where do you set DPPs?

Answer 7

On a Log Group

Question 8

Log Security

What happens when a DPP finds something bad in a log?

Answer 8

Can redact it or send an audit message elsewhere