Centralized VPC Flow Log Collection for Multiple Accounts using S3 and Athena
A security team wants to centrally collect and analyze VPC Flow Logs from multiple AWS accounts for security monitoring. Which solution is MOST scalable and cost-effective?
Quick Answer
The combination of delivering VPC Flow Logs to a centralized S3 bucket across all AWS Organizations accounts and querying them with Amazon Athena is the most scalable and cost-effective approach because it relies entirely on managed, serverless components rather than infrastructure that has to be provisioned, sized, or maintained. S3 offers durable, low-cost storage that naturally scales as log volume grows across hundreds of accounts, and Athena runs SQL queries directly against that data on a pay-per-query basis, so there is no always-on compute layer sitting idle between analysis sessions. This is a meaningfully different cost and operations profile from a solution built around EC2 instances or a continuously running streaming pipeline, both of which require capacity planning, patching, and scaling work even when no one is actively querying the logs. AWS Organizations is what makes the centralization itself practical at scale, since it allows Flow Logs to be delivered from every member account into one destination bucket without configuring log shipping account by account. The broader concept to take away is that when a question emphasizes both scalability across many accounts and cost-effectiveness, that combination is usually pointing toward serverless storage-plus-query patterns like S3 and Athena rather than compute-based log aggregation, since serverless services scale automatically and only incur cost when actually used, which is exactly what a security team collecting logs from hundreds of accounts needs.
⚠ Common exam trap
The trap here is that candidates often overcomplicate the solution by choosing a streaming or real-time processing service (like Kinesis or CloudWatch Logs) when the requirement is for cost-effective batch analysis, not real-time alerting.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Organizations to centralize logging by delivering VPC Flow Logs to a centralized S3 bucket and query with Amazon Athena.
Using AWS Organizations to centrally deliver VPC Flow Logs to a centralized S3 bucket, then querying with Amazon Athena, is both scalable and cost-effective. S3 provides durable, low-cost storage for large volumes of log data, and Athena allows serverless, pay-per-query analysis without provisioning infrastructure. This approach avoids the operational overhead of managing EC2 instances or streaming pipelines, and scales seamlessly as log volume grows.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Aggregate logs in an EC2 instance running an ELK stack.
Why it's wrong here
EC2 is not managed or scalable.
- ✗
Use Amazon Kinesis Data Firehose to stream logs to an S3 bucket and process with AWS Lambda.
Why it's wrong here
Kinesis and Lambda add cost and complexity.
- ✗
Configure VPC Flow Logs to send to a centralized CloudWatch Logs account using cross-account subscriptions.
Why it's wrong here
Cross-account subscriptions incur data transfer costs and are less scalable.
- ✓
Use AWS Organizations to centralize logging by delivering VPC Flow Logs to a centralized S3 bucket and query with Amazon Athena.
Why this is correct
This approach is scalable, cost-effective, and uses managed services.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security engineer needs to centrally collect and analyze AWS CloudTrail logs from multiple accounts. Which service is designed for this purpose?
easy- A.Configure each account to send logs to a central S3 bucket
- B.Enable Amazon GuardDuty in each account and aggregate findings
- C.Use Amazon CloudWatch Logs to stream logs from each account to a central account
- ✓ D.Use AWS Organizations to create a CloudTrail trail that applies to all accounts
Why D: AWS Organizations allows you to create a single CloudTrail trail that applies to all accounts in the organization, centrally collecting management and data events into a single S3 bucket (and optionally CloudWatch Logs). This eliminates the need to manually configure trails in each account and ensures consistent logging across the entire organization, meeting the requirement for central collection and analysis.
Variation 2. A company wants to centrally collect and analyze logs from multiple AWS accounts. Which AWS service should be used to aggregate logs from various sources for monitoring and alerting?
easy- A.Amazon S3
- B.AWS Config
- C.AWS CloudTrail
- ✓ D.Amazon CloudWatch Logs
Why D: Amazon CloudWatch Logs is the correct service because it provides a centralized platform for collecting, monitoring, and analyzing log data from multiple AWS accounts and on-premises sources. It supports cross-account log aggregation via subscription filters and cross-account destinations, enabling real-time monitoring and alerting through CloudWatch Logs Insights and metric filters. This makes it the appropriate choice for the stated requirement of central log aggregation for monitoring and alerting.
Variation 3. Which TWO AWS services can be used to centrally collect and analyze logs from multiple AWS accounts? (Select TWO.)
easy- A.AWS Config
- ✓ B.Amazon Athena (to query logs in S3)
- ✓ C.Amazon S3 (as a central log repository)
- D.Amazon Inspector
- E.AWS Shield
Why B: Amazon S3 can serve as a centralized log repository by aggregating logs from multiple AWS accounts using cross-account S3 bucket policies. Amazon Athena can then query those logs directly in S3 using standard SQL, enabling centralized analysis without moving data. Together, they provide a scalable, serverless solution for multi-account log collection and analysis.
Variation 4. Which TWO AWS services can be used to centrally collect and analyze logs from multiple AWS accounts? (Choose two.)
medium- ✓ A.Amazon CloudWatch Logs
- B.AWS CloudTrail
- C.Amazon Kinesis Data Firehose
- D.Amazon Athena
- ✓ E.Amazon S3
Why A: Amazon CloudWatch Logs can centrally collect logs from multiple AWS accounts by using cross-account subscription filters or by aggregating logs into a central account via CloudWatch Logs destination. This enables centralized monitoring and analysis of log data from various sources, meeting the requirement for a multi-account log collection and analysis solution.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.