Centralized VPC Flow Log Collection for Multiple Accounts using S3 and Athena
A security team wants to centrally collect and analyze VPC Flow Logs from multiple AWS accounts for security monitoring. Which solution is MOST scalable and cost-effective?
Quick Answer
The combination of delivering VPC Flow Logs to a centralized S3 bucket across all AWS Organizations accounts and querying them with Amazon Athena is the most scalable and cost-effective approach because it relies entirely on managed, serverless components rather than infrastructure that has to be provisioned, sized, or maintained. S3 offers durable, low-cost storage that naturally scales as log volume grows across hundreds of accounts, and Athena runs SQL queries directly against that data on a pay-per-query basis, so there is no always-on compute layer sitting idle between analysis sessions. This is a meaningfully different cost and operations profile from a solution built around EC2 instances or a continuously running streaming pipeline, both of which require capacity planning, patching, and scaling work even when no one is actively querying the logs. AWS Organizations is what makes the centralization itself practical at scale, since it allows Flow Logs to be delivered from every member account into one destination bucket without configuring log shipping account by account. The broader concept to take away is that when a question emphasizes both scalability across many accounts and cost-effectiveness, that combination is usually pointing toward serverless storage-plus-query patterns like S3 and Athena rather than compute-based log aggregation, since serverless services scale automatically and only incur cost when actually used, which is exactly what a security team collecting logs from hundreds of accounts needs.
⚠ Common exam trap
The trap here is that candidates often overcomplicate the solution by choosing a streaming or real-time processing service (like Kinesis or CloudWatch Logs) when the requirement is for cost-effective batch analysis, not real-time alerting.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Organizations to centralize logging by delivering VPC Flow Logs to a centralized S3 bucket and query with Amazon Athena.
Using AWS Organizations to centrally deliver VPC Flow Logs to a centralized S3 bucket, then querying with Amazon Athena, is both scalable and cost-effective. S3 provides durable, low-cost storage for large volumes of log data, and Athena allows serverless, pay-per-query analysis without provisioning infrastructure. This approach avoids the operational overhead of managing EC2 instances or streaming pipelines, and scales seamlessly as log volume grows.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Aggregate logs in an EC2 instance running an ELK stack.
Why it's wrong here
A self-managed ELK stack on a single EC2 instance requires manual scaling, patching and capacity planning, and cannot elastically absorb flow logs from many accounts. It is tempting because ELK offers rich search and dashboards, and would be correct for bespoke on-premises log analytics, but the scenario demands scalable, cost-effective managed ingestion.
- ✗
Use Amazon Kinesis Data Firehose to stream logs to an S3 bucket and process with AWS Lambda.
Why it's wrong here
Firehose plus Lambda builds a custom ingestion and parsing pipeline that the team must operate, and Lambda invocation and S3 storage costs accrue per record. It is tempting because it is serverless and flexible, and would be correct for bespoke transformation of streaming data, but Security Lake natively normalises and centralises multi-account flow logs.
- ✗
Configure VPC Flow Logs to send to a centralized CloudWatch Logs account using cross-account subscriptions.
Why it's wrong here
Cross-account CloudWatch Logs subscriptions centralise flow logs, but CloudWatch Logs ingestion and storage pricing is higher than S3-based options at volume. It is tempting because subscriptions are a native cross-account mechanism, and would be correct for near-real-time metric filters and alarms, but the scenario prioritises scalability and cost-effectiveness.
- ✓
Use AWS Organizations to centralize logging by delivering VPC Flow Logs to a centralized S3 bucket and query with Amazon Athena.
Why this is correct
AWS Organizations centralises log delivery across accounts into one S3 bucket, avoiding per-account pipelines. Athena queries that bucket serverlessly, paying only per query, which satisfies the scalability and cost-effectiveness constraints for multi-account VPC Flow Log analysis.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,205 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security engineer needs to centrally collect and analyze AWS CloudTrail logs from multiple accounts. Which service is designed for this purpose?
easy- A.Configure each account to send logs to a central S3 bucket
- B.Enable Amazon GuardDuty in each account and aggregate findings
- C.Use Amazon CloudWatch Logs to stream logs from each account to a central account
- ✓ D.Use AWS Organizations to create a CloudTrail trail that applies to all accounts
Why D: AWS Organizations allows you to create a single CloudTrail trail that applies to all accounts in the organization, centrally collecting management and data events into a single S3 bucket (and optionally CloudWatch Logs). This eliminates the need to manually configure trails in each account and ensures consistent logging across the entire organization, meeting the requirement for central collection and analysis.
Variation 2. A company wants to centrally collect and analyze logs from multiple AWS accounts. Which AWS service should be used to aggregate logs from various sources for monitoring and alerting?
easy- A.Amazon S3
- B.AWS Config
- C.AWS CloudTrail
- ✓ D.Amazon CloudWatch Logs
Why D: Amazon CloudWatch Logs is the correct service because it provides a centralized platform for collecting, monitoring, and analyzing log data from multiple AWS accounts and on-premises sources. It supports cross-account log aggregation via subscription filters and cross-account destinations, enabling real-time monitoring and alerting through CloudWatch Logs Insights and metric filters. This makes it the appropriate choice for the stated requirement of central log aggregation for monitoring and alerting.
Variation 3. Which TWO AWS services can be used to centrally collect and analyze logs from multiple AWS accounts? (Select TWO.)
easy- A.AWS Config
- ✓ B.Amazon Athena (to query logs in S3)
- ✓ C.Amazon S3 (as a central log repository)
- D.Amazon Inspector
- E.AWS Shield
Why B: Amazon S3 can serve as a centralized log repository by aggregating logs from multiple AWS accounts using cross-account S3 bucket policies. Amazon Athena can then query those logs directly in S3 using standard SQL, enabling centralized analysis without moving data. Together, they provide a scalable, serverless solution for multi-account log collection and analysis.
Variation 4. Which TWO AWS services can be used to centrally collect and analyze logs from multiple AWS accounts? (Choose two.)
medium- ✓ A.Amazon CloudWatch Logs
- B.AWS CloudTrail
- C.Amazon Kinesis Data Firehose
- D.Amazon Athena
- ✓ E.Amazon S3
Why A: Amazon CloudWatch Logs can centrally collect logs from multiple AWS accounts by using cross-account subscription filters or by aggregating logs into a central account via CloudWatch Logs destination. This enables centralized monitoring and analysis of log data from various sources, meeting the requirement for a multi-account log collection and analysis solution.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.