Centralized Logging Pattern

In a multi-account AWS organization the Log Archive account is the single destination for all audit and application logs. Every other account forwards its CloudTrail trails and CloudWatch Log Groups into this central account, which stores them durably in S3 with appropriate encryption, lifecycle management, and access controls.

In this lab you will:

• Create an S3 log archive bucket with versioning, SSE-S3, a permission policy accepting writes from CloudTrail and CloudWatch Logs, block-public-access, and a lifecycle rule transitioning objects to STANDARD_IA after 30 days
• Create a customer-managed KMS key whose policy grants CloudTrail encryption rights, then create a multi-region CloudTrail trail delivering to the archive bucket with SSE-KMS and log file validation enabled
• Create a CloudWatch Log Group, a Kinesis Data Stream, and a CloudWatch Logs subscription filter routing only ERROR-level log events to the stream
• Create an IAM role for Kinesis Data Firehose with S3 write and Kinesis read permissions, then create a Firehose delivery stream that reads from the Kinesis Data Stream, compresses with GZIP, and writes to the archive bucket with Hive-style date-partitioning
• Inject a test log event, trace it end-to-end through the pipeline, confirm the lifecycle policy is applied, and generate a pipeline summary report

Everything runs in a single TeKanAid-provisioned AWS lab account using confirmed-tier services (S3, KMS, CloudTrail, CloudWatch Logs, Kinesis Data Streams, Kinesis Data Firehose, IAM).