Exam AWS Certified Security - Specialty topic 1 question 229 discussion

B. Console login event in CWE

Answer: B

By using CloudTrail logs and CloudWatch Events, the security engineer can set up a rule to monitor for account root user logins. When a root user login event is detected in the CloudTrail logs, CloudWatch Events can trigger an AWS Lambda function. This Lambda function can then send an Amazon SNS notification to the security team's distribution list, providing near-real-time alerts for root user logins.

Although you don't need the lambda to implement this. B

One way to do this is by using an Amazon CloudWatch Events rule that detects any AWS account root user API events and triggers an AWS Lambda function. The Lambda function then processes the root API event and publishes a message to an Amazon SNS topic, where the subject contains the AWS account ID or AWS account alias where the root API call was detected and the type of API activity. The SNS topic then sends notifications to its email subscribers about this event. B

Option B make sense to me.

Question ask real time (C & D out) B. Run AWS CloudTrail logs through Amazon CloudWatch Events to detect account root user logins and trigger an AWS Lambda function to send an Amazon SNS notification to the security teamג€™s distribution list.

CT/CW,/SNS equal B

B -- 100%

B . .sure