AWS Certified Data Engineer – Associate (DEA-C01) — Question 75

A company has a production AWS account that runs company workloads. The company's security team created a security AWS account to store and analyze security logs from the production AWS account. The security logs in the production AWS account are stored in Amazon CloudWatch Logs.
The company needs to use Amazon Kinesis Data Streams to deliver the security logs to the security AWS account.
Which solution will meet these requirements?

Answer options

• A. Create a destination data stream in the production AWS account. In the security AWS account, create an IAM role that has cross-account permissions to Kinesis Data Streams in the production AWS account.
• B. Create a destination data stream in the security AWS account. Create an IAM role and a trust policy to grant CloudWatch Logs the permission to put data into the stream. Create a subscription filter in the security AWS account.
• C. Create a destination data stream in the production AWS account. In the production AWS account, create an IAM role that has cross-account permissions to Kinesis Data Streams in the security AWS account.
• D. Create a destination data stream in the security AWS account. Create an IAM role and a trust policy to grant CloudWatch Logs the permission to put data into the stream. Create a subscription filter in the production AWS account.

Correct answer: D

Explanation

Option D is correct because it allows CloudWatch Logs in the production account to send data to the Kinesis Data Stream in the security account, fulfilling the requirement to transfer security logs. Options A and C incorrectly place the data stream in the production account, which does not meet the requirement for the security AWS account. Option B does not specify the necessary subscription filter setup in the production account, which is required for the logs to be processed correctly.