AWS services that monitor events and provide alarms (for example, CloudWatch, EventBridge)

What is the main purpose of AWS CloudWatch?

The main purpose of AWS CloudWatch is to provide monitoring and observability of AWS resources and customer workloads running on AWS. It collects and tracks metrics, collects and monitors log files, sets alarms, and automatically reacts to changes in AWS resources.

Can you explain how you would use AWS CloudWatch to detect potential security threats?

AWS CloudWatch can be used to detect potential security threats by setting up monitoring on logs and metrics that could indicate unauthorized or suspicious activity. For example, an alarm could be set for an abnormally high number of login attempts, which could indicate a brute force attack. CloudTrail logs can be monitored for unusual API activity, and CloudWatch Insights can be used to query and analyze these logs for patterns that could suggest a security threat.

How do events in AWS CloudWatch Events and Amazon EventBridge differ, and what was the reason for introducing EventBridge when CloudWatch Events already existed?

AWS CloudWatch Events mainly allows you to respond to state changes in AWS resources. Amazon EventBridge, on the other hand, builds upon and extends CloudWatch Events by offering a broader event bus service that not only handles AWS events but also supports events from SaaS applications and other AWS accounts, allowing for a more flexible and scalable event-driven architecture. EventBridge was introduced to provide a more robust solution for event-driven application architectures and offers features such as Schema Registry and different event buses for better event management and discovery.

How can CloudWatch Alarms be used to automate responses to security incidents?

CloudWatch Alarms can automatically trigger actions in response to security incidents when a certain threshold is breached. These actions can include launching Auto Scaling policies, triggering Lambda functions, or sending notifications through SNS. For example, a Lambda function could be invoked to isolate a compromised EC2 instance when an alarm is triggered due to unexpected outbound traffic patterns.

What AWS service would you use to execute automated workflows in response to events without writing code for polling or managing message queues, and how does it relate to monitoring events and alarms?

I would use AWS Step Functions, which can orchestrate multiple AWS services into serverless workflows triggered by events without the need for polling or managing message queues. This relates to monitoring events and alarms as Step Functions can be triggered by CloudWatch Events or EventBridge, enabling automatic response to alarms or changes in your AWS environment.

How would you set up an alarm to monitor for DDoS attacks using AWS services, and which service metrics would you use?

To monitor for DDoS attacks, I would set up CloudWatch Alarms on metrics such as network in/out bytes or request counts that are provided by services like Amazon CloudFront, AWS WAF, or Elastic Load Balancing. Sudden spikes in these metrics could indicate a potential DDoS attack. AWS Shield Advanced also provides additional DDoS protection metrics that can be used to create alarms.

What is the difference between Amazon CloudWatch Logs and Amazon CloudWatch Metrics, and how are they both used in monitoring?

Amazon CloudWatch Logs is used to monitor, store, and access log files from AWS resources, Lambda functions, and other sources. CloudWatch Metrics, on the other hand, provides numerical data about the performance of AWS services and resources. Both are used in monitoring to get a comprehensive view of system health and performance, with Logs providing detailed event records (such as user activity or error messages) and Metrics providing quantitative measures (such as CPU utilization or disk I/O).

In the context of AWS, what is log retention and how is it configured in CloudWatch?

Log retention in AWS refers to the duration for which log data is kept in CloudWatch Logs before it is automatically deleted. It is configured in CloudWatch by setting a retention policy on a log group, which can vary from one day to indefinitely (never expire), depending on the importance of the logs and compliance requirements.

Can you describe how you would use Amazon EventBridge to integrate custom applications with AWS services for security monitoring?

Amazon EventBridge can be used to integrate custom applications by sending events from the application to a custom EventBridge bus. These events can then be matched with rules that route them to various AWS services, enabling actions such as invoking a Lambda function to analyze the event for security anomalies or storing the events in an S3 bucket for long-term analysis.

How would you use AWS CloudWatch’s anomaly detection feature to enhance security monitoring, and what kind of anomalies might you monitor?

AWS CloudWatch’s anomaly detection feature can be used to create alarms based on expected patterns of metrics, and identify when actual metrics deviate from these expected patterns. For security monitoring, you might monitor anomalies in network traffic, such as a sudden spike in outbound traffic that could indicate data exfiltration, or an abnormal increase in login failures that might suggest a brute force attack.