Study Guides/AWS Cybersecurity Notes/Parsing logs and events

Important points to consider

• Build a resillant storage solution.

• Store log files centrally.

• Ensure integirity is maintained.

• Know retention policies.

• Know the process for adding new logs.

• Who to grant read access to.

• Monitor storage.

Soring logs in S3

The obvious solution.

Provdies resiliant long term storage for data.

The problem with S3 is the ability to search files - it's just a file system not an RDB.

S3 has several storage tiers

• S3 Standard

Highly available but most expensive.

Ideal for requent access to logs.

99.99% avalability and 99.999999999% ( 5 9's ) diability.

Can encrypt data at rest or in transit (SSL).

• S3 Standard Infrequent access.

Designed for files >128kb

If a file is less than 128 kb your charged for 128 kb - not a big deal unless you have lots of small files.

Designed for extended storage peroids >30 days - Minimum charge is 30 days.

Storage is lower cost but there are higher charges for actions (GET / PUT / COPY / POST / LIST / SELECT).

No delays to access objects - realtime access.

basically the same as S3 Standard but lower storage costs / ideal for infrequent access.

• S3 One Zone IA.

Lowest cost point.

Same as Standard IA but only in one zone.

Ideal if you are already replicating the data.

Risk of data loss - all your data is on One Zone.

Resillancey and avlability is the same.