AWS Certified DevOps Engineer – Professional (DOP-C02) — Question 253

A company sends its AWS Network Firewall flow logs to an Amazon S3 bucket. The company then analyzes the flow logs by using Amazon Athena.

The company needs to transform the flow logs and add additional data before the flow logs are delivered to the existing S3 bucket.

Which solution will meet these requirements?

Answer options

• A. Create an AWS Lambda function to transform the data and to write a new object to the existing S3 bucket. Configure the Lambda function with an S3 trigger for the existing S3 bucket. Specify all object create events for the event type. Acknowledge the recursive invocation.
• B. Enable Amazon EventBridge notifications on the existing S3 bucket. Create a custom EventBridge event bus. Create an EventBridge rule that is associated with the custom event bus. Configure the rule to react to all object create events for the existing S3 bucket and to invoke an AWS Step Functions workflow. Configure a Step Functions task to transform the data and to write the data into a new S3 bucket.
• C. Create an Amazon EventBridge rule that is associated with the default EventBridge event bus. Configure the rule to react to all object create events for the existing S3 bucket. Define a new S3 bucket as the target for the rule. Create an EventBridge input transformation to customize the event before passing the event to the rule target.
• D. Create an Amazon Kinesis Data Firehose delivery stream that is configured with an AWS Lambda transformer. Specify the existing S3 bucket as the destination. Change the Network Firewall logging destination from Amazon S3 to Kinesis Data Firehose.

Correct answer: D

Explanation

The correct answer is D because it allows for real-time transformation of the flow logs as they are ingested into Kinesis Data Firehose, making it suitable for modifying and enriching data before delivery. Option A does not effectively address the requirement to transform data before it reaches S3; it only processes data after it's already there. Option B involves a more complex setup with Step Functions and a new bucket that doesn't directly meet the requirement of transforming data before delivery. Option C also fails to address the transformation requirement directly, as it only modifies events without processing the logs themselves.