A company uses AWS Organizations to manage its AWS accounts. The company wants its monitoring system to receive an alert when a root user logs in. The company also needs a dashboard to display any log activity that the root user generates.
Which combination of steps will meet these requirements? (Choose three.)
To meet the requirements of receiving an alert when a root user logs in and displaying log activity on a dashboard, the company should follow these steps: First, create an AWS CloudTrail organization trail to capture all activities, including root user logins, across all accounts and send these events to Amazon CloudWatch Logs. Second, create an Amazon CloudWatch Logs metric filter to match root user login events, and configure a CloudWatch alarm and an Amazon Simple Notification Service (Amazon SNS) topic to send alerts to the company's monitoring system. Third, use CloudWatch Logs Insights to create queries to extract and visualize log data related to root user activity on a CloudWatch dashboard, providing a centralized view of root user actions.
Correct answer.
---> CEF
E- AWS CloudTrail will log all activities, including root user logins, across all accounts in the organisation. Sending these logs to CloudWatch Logs enables further processing and analysis. C- Creating a metric filter to detect root user login events will allow you to trigger a CloudWatch alarm. The alarm can then send notifications via SNS to the company's monitoring system, ensuring real-time alerts for root user logins. F- Using CloudWatch Logs Insights, you can create queries to extract and visualise log data related to root user activity. This data can be displayed on a CloudWatch dashboard, providing a centralised view of root user actions.
E first, then C, and the last is F E ensures that all events, including root user login events, are captured across all accounts in the organization. By sending these events to CloudWatch Logs, you centralize the logging data, making it accessible for further processing. C creating a metric filter in CloudWatch Logs to detect specific patterns in the log data, such as root user login events. F creating a CloudWatch dashboard that utilizes CloudWatch Logs Insights to query and visualize the log data. This dashboard can be used to display detailed information about root user login activity and other relevant log events.