Centralize CloudTrail Logs to S3 Across Accounts and Regions

• A.Create IAM roles in each account to allow the central bucket to read logs.
• ✓ B.Create a bucket policy on the central S3 bucket that grants permissions to the source accounts.
• C.Enable CloudTrail organization trail in the management account to deliver logs to the central bucket.
• D.Set up a cross-account subscription in CloudWatch Logs to forward logs to the central account.
• ✓ E.Configure each account’s services (e.g., CloudTrail, VPC Flow Logs) to deliver logs to the central S3 bucket.

Why B: Option B is correct because a bucket policy on the central S3 bucket can grant cross-account permissions to source accounts to write logs. This allows services like CloudTrail and VPC Flow Logs from member accounts to deliver logs directly to the central bucket without requiring IAM roles in each account for reading logs.

• A.Enable VPC Flow Logs for all VPCs in every account and send them to the centralized bucket
• ✓ B.Create an S3 bucket in the central logging account with bucket policies allowing cross-account writes
• ✓ C.Enable AWS CloudTrail in each account and configure it to deliver logs to the centralized S3 bucket
• D.Set up Amazon Kinesis Data Streams in the central account to ingest logs from all accounts
• ✓ E.Configure Amazon CloudWatch Logs subscription filters to stream logs from each account to the centralized S3 bucket via Kinesis Data Firehose

Why B: Options B, C, and E are correct. To set up centralized logging across multiple AWS accounts using AWS Organizations: B) Create an S3 bucket in the central logging account with a bucket policy that allows cross-account writes from other accounts. C) Enable AWS CloudTrail in each account and configure it to deliver logs to the centralized S3 bucket. This captures API activity. E) Configure Amazon CloudWatch Logs subscription filters in each account to stream logs (e.g., from applications or services) to the centralized S3 bucket via Kinesis Data Firehose. Option A (VPC Flow Logs) is not required for all accounts—it can be selectively enabled. Option D (Kinesis Data Streams) is not necessary; logs can be delivered directly to S3 via Firehose or CloudTrail.

• A.Configure each account to send logs to a central CloudWatch Logs account, then export to S3.
• B.Use Amazon Kinesis Data Firehose in each account to stream logs to a central S3 bucket.
• C.Create an S3 bucket in each account and use S3 replication to copy logs to the central bucket.
• ✓ D.Configure each account to deliver logs directly to a central S3 bucket using a bucket policy that allows cross-account writes.

Why D: Option D is the most operationally efficient because it allows each account to deliver logs like CloudTrail and VPC Flow Logs directly to a central S3 bucket via a bucket policy permitting cross-account writes. For Amazon RDS audit logs, which cannot be sent directly to a cross-account S3 bucket, you can configure them to be published to CloudWatch Logs within the same account and then use a subscription filter to forward them to the central S3 bucket. This hybrid approach minimizes overhead compared to other options: Option A (exporting from a central CloudWatch Logs account) adds unnecessary complexity; Option B (Kinesis Data Firehose in each account) introduces additional services and cost; Option C (S3 replication) requires per-account bucket setup and management. Thus, D best balances direct delivery for most logs with a simple workaround for RDS audit logs.