The Logging Architecture

The evidence layer: CloudTrail management, data and Insights events with organization trails and CloudTrail Lake, CloudWatch Logs from agent to subscription filter, choosing network and service logs by threat, and making the record tamper-resistant.

Content current as of 2026-10.

Lessons

1. CloudTrail, end to end
2. CloudWatch Logs architecture
3. Network and service logs
4. Retention, immutability, and protecting the evidence

Sources

• SCS-C03 exam guide — Content Domain 1 (tasks 1.1–1.3)
• Validating CloudTrail log file integrity
• VPC Flow Logs — flow log limitations
• Amazon S3 — using S3 Object Lock