Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 240 discussion

Notify only the designated system administrator who is assigned to the specific bastion host.

C - Retreiving the logs and send it to CloudWatch -> Create metrics filter -> Send alarm when over threshold -> SNS to designated system administrator. A - We are no need EventBridge to send the event based on cloudwatch metrics filter. B&D - is allow you to manage the EC2 instance like patch or automation and not for collect the log or log pasring.

"must notify only the designated system administrator who is assigned to the specific bastion host."

Amazon CloudWatch agent can collect operating system logs, including login attempts. Amazon EventBridge can be used to create rules that trigger alarms based on specific patterns in the logs, such as failed login attempts. Amazon SNS can send notifications when the alarm threshold is exceeded. Using EC2 instance tags allows you to direct notifications to the appropriate SNS topics, ensuring that only the designated system administrator for the specific bastion host receives the alerts. This solution leverages native AWS services effectively and minimizes operational overhead by automating the detection and notification process.

CloudWatch Agent and Logs: The Amazon CloudWatch agent is configured to collect operating system logs, making it an ideal choice for monitoring failed login attempts. CloudWatch Alarm and Metric Filter: Creating a CloudWatch alarm based on a metric filter for failed login attempts ensures that you can set up precise conditions, such as 5 failed attempts within a 5-minute period. SNS and Messaging Filters: Amazon SNS is used to send alerts when the threshold is exceeded. SNS messaging filters can be used to control who receives notifications, ensuring that only the designated system administrator for the specific bastion host is notified. Option A includes using EventBridge to configure the alarm, which is an additional layer that isn't necessary for this specific requirement.

the difference between A and C is that A uses event bridge and tags that can be referenced to route the request to a different sns topic each time, while C uses a single sns and no eventbridge A is the answer because correct routing is an important aspect in the requirements

No need for Eventbridge, use cloudwatch alarms

Use metrics filter