A regulated company requires that DevOps engineers must not sign in to EC2 instances except for emergencies. If a login does occur, the security team must be alerted within 15 minutes. Which solution meets this requirement reliably?
Choose an answer
Tap an option to check your answer.
Correct answer: Install the Amazon CloudWatch agent on each EC2 instance to stream logs to CloudWatch Logs, create a CloudWatch metric filter that detects user login events, and trigger an SNS notification to the security team when a login is found..
Why this is the answer
The correct solution leverages the CloudWatch agent to stream detailed logs, including user login events, from EC2 instances to CloudWatch Logs. A CloudWatch metric filter can then efficiently scan these logs for specific patterns indicating a login. This filter, when triggered, can directly publish to an SNS topic, ensuring the security team receives a timely alert within the 15-minute requirement. Incorrect options: Amazon Inspector focuses on vulnerability management, not real-time login event detection from instance logs. While CloudTrail records API calls, it doesn't capture direct SSH/console logins to EC2 instances. Kinesis and Lambda add unnecessary complexity and latency for this specific requirement. Pushing logs to S3 and using Athena introduces significant latency for real-time alerting, making it unsuitable for the 15-minute notification requirement.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed