A central security account must collect VPC flow logs from dozens of accounts in one organization. The logs must land in an S3 bucket in the security account and be encrypted with a KMS key that the security account owns. Which destination satisfies this?
Show answer and explanation
Answer: A
VPC Flow Logs can publish to CloudWatch Logs, to S3, or to Kinesis Data Firehose. Cross-account delivery to S3 works when the bucket policy permits the flow logs delivery service from the source accounts, and the KMS key policy allows that service to encrypt with the key. This is the common central logging pattern for security teams.
Why the other options are wrong
- B. Flow Logs cannot publish to DynamoDB directly. A table would need an external pipeline, because it is not a native destination.
- C. EBS volumes are block storage attached to one instance. Flow Logs do not write to them, and they cannot be shared across accounts.
- D. SQS is not a supported Flow Logs destination, so flow records cannot be delivered directly from the VPC into a queue.