The Log Pipeline That Makes Federal Security Auditable

AWS-Native Security Operations Series | Part 3 of 6

How CloudTrail, CloudWatch, Kinesis, OpenSearch, and S3 work together to capture, process, and preserve the evidence your authorization depends on.

Detection tells you something happened. The log pipeline tells you what happened, when it happened, what led up to it, and what followed. In a federal environment, that distinction isn't academic. It's the difference between an incident you can investigate and report on, and an incident you can only acknowledge.

The FedRAMP question 'can you produce the logs from that date' is not hypothetical. We've had that conversation with customers and with assessors. The answer depends entirely on whether the log pipeline was built for durability or built for convenience.

Ours is built for durability.

CloudTrail: the API audit trail

Amazon CloudTrail captures API activity across every AWS service in the customer environment. Every API call, every management event, every data event, across every region and every account in an AWS Organization, with the identity of the caller, the time, the source IP, and the parameters passed.

CloudTrail is the foundational audit record for AWS environments. When an incident occurs, when an assessor asks for evidence, when an insider threat investigation requires reconstruction of activity over time, CloudTrail is the record that answers the question.

In our ConMon deployments, CloudTrail is enabled with multi-region logging, log file validation enabled for tamper detection, and S3 access logging on the CloudTrail bucket itself. We also enable CloudTrail Insights on high-activity accounts to detect unusual API call volumes that can indicate automated attack activity or compromised credentials operating at scale.

Amazon CloudWatch: operational telemetry

CloudWatch collects infrastructure metrics, application logs, and VPC Flow Logs, providing the operational telemetry layer that sits alongside CloudTrail's API audit trail.

VPC Flow Logs captured through CloudWatch give us network-level visibility: what traffic is flowing between resources, what connections are being made to external IPs, what ports are in use. Combined with GuardDuty's analysis of the same flow data, our analysts have both the raw evidence and the interpreted signal.

CloudWatch also provides the metric filters we use for CIS Benchmark alerting: unauthorized API calls, console login without MFA, root account usage, security group changes, network ACL changes, CloudTrail configuration changes, and other events that the CIS AWS Foundations Benchmark identifies as requiring immediate alert. These alerts feed into our SIEM as high-priority findings that bypass standard triage queues.

Amazon Kinesis Data Streams: the throughput layer

Log volume in an active federal AWS environment is substantial. CloudTrail alone in a multi-account organization can generate millions of events per day. CloudWatch adds infrastructure metrics and VPC Flow Log records on top. Without a capable ingestion layer, that volume overwhelms downstream systems or creates processing backlogs that delay detection.

Kinesis Data Streams is our throughput layer. It ingests the combined log feed in real time, handles volume spikes without dropping events, and decouples ingestion from processing so that a spike in CloudTrail events doesn't create a queue in the SIEM.

The decoupling matters operationally. If OpenSearch has a brief processing delay, logs don't get dropped. They're in Kinesis, waiting to be processed. If we need to replay a window of events for investigation or reprocessing, Kinesis retains the stream. That durability is built into the architecture, not added after an incident reveals the gap.

Amazon OpenSearch Service: the SIEM engine

OpenSearch is our SIEM engine. Log data flows from Kinesis into OpenSearch, where our custom detection rules, correlation logic, and analyst dashboards run.

OpenSearch gives us the search and analytics capability to query across billions of log events in near-real time. When an analyst needs to investigate a GuardDuty finding, they can pull every CloudTrail event associated with the relevant IAM identity in the prior 24 hours in seconds. When a ConMon scan surfaces a new finding, the analyst can check whether any related activity appeared in the logs before the finding was detected.

Our detection rules in OpenSearch are environment-specific, not generic templates applied uniformly across customers. The rules are tuned to each customer's baseline behavior, their expected API call patterns, their normal authentication sources, and their typical traffic flows. That specificity is what separates signal from alert fatigue. A rule that fires on every S3 GetObject call in a media company creates noise. The same rule tuned to fire on S3 GetObject calls to buckets with sensitive classifications from unexpected principals creates signal.

Amazon S3: the immutable evidence layer

S3 sits underneath the entire pipeline as the immutable evidence layer. It performs three distinct functions depending on customer requirements.

Immutable log archiving. Raw CloudTrail logs, VPC Flow Logs, and CloudWatch log exports are archived to S3 with Object Lock enabled in COMPLIANCE mode. Object Lock in COMPLIANCE mode means no one, including root account holders, can delete or modify the logs during the retention period. That's the tamper-proof record that satisfies auditor questions about log integrity.

ConMon evidence packages. Scan results, Inspector findings, Config compliance reports, and POA&M supporting evidence are stored in S3 as structured evidence packages. These packages are the artifacts that support monthly ConMon deliverables, annual assessment evidence requests, and incident investigation documentation.

Long-term retention. For customers with extended retention requirements, S3 Glacier handles archival storage where cost efficiency matters more than retrieval speed. Logs that need to be retained for three to seven years for compliance purposes don't need to sit in hot storage. Glacier keeps them accessible when needed at a fraction of the cost.