DOP-C02 Practice Question 7: Cross Account Log Centralization
AWS Certified DevOps Engineer – Professional (DOP-C02) · Test 1 · question 7 of 10
Forty application accounts each write structured application logs to CloudWatch Logs. A central Security account must receive a continuous, near-real-time copy of every ERROR-level log event from all forty accounts and land it in one Amazon S3 bucket for long-term analysis. The solution must not require a scheduled job, must not require the Security account to hold credentials in the application accounts, and must let the Security team revoke a single account's access without touching the other thirty-nine.
Which design meets these requirements?
Show answer and explanation
Answer:
This is the standard cross-account log data sharing pattern. The recipient account creates a CloudWatch Logs *destination* (PutDestination) that encapsulates the delivery stream, and attaches a *destination access policy* (PutDestinationPolicy) listing which sender accounts may call PutSubscriptionFilter against it. Each sender account then creates a subscription filter on its log group, using the destination ARN as the target and a filter pattern so only ERROR events are shipped. Delivery is event-driven and continuous, so there is no scheduled job; the trust lives in a resource policy in the Security account, so no cross-account credentials are handed out; and revoking one account is a single edit to that destination policy, which is what the last constraint is testing. Note that the log group and the destination must be in the same Region, though Firehose can deliver onward to a bucket elsewhere.
Option B misunderstands what EventBridge carries. CloudWatch Logs does not emit log events to EventBridge (EventBridge sees API and service *events*, not the contents of log streams), so there is nothing for the rule to match. EventBridge also has no native S3 delivery target of the kind described.
Option C works but violates two explicit constraints: it is a polling job on a schedule, and it requires cross-account role assumption managed across forty accounts. Repeatedly calling FilterLogEvents at scale is also throttle-prone and lossy compared to subscription delivery.
Option D fails the near-real-time requirement outright. CreateExportTask is a batch operation, one task at a time per account, unsuitable for continuous delivery, and it cannot target a bucket on an hourly automatic schedule without additional orchestration. Filtering after the fact with Object Lambda also means every non-ERROR event is still stored and paid for.
Reference: Cross-account cross-Region log data sharing using Firehose