Lesson 02 — Enterprise Logging Strategy, Centralised Log Architecture & Security Telemetry Governance

Learning Path

☁️ Phase 02 – AWS Cloud Security

📘 Module 13 – Enterprise Security Operations, Logging, Monitoring & Threat Detection

🎯 Lesson Objectives

By the end of this lesson, you will be able to:

Explain the purpose of enterprise logging.
Understand security telemetry.
Design enterprise logging strategies.
Build centralised logging architectures.
Design AWS Log Archive Accounts.
Classify enterprise log sources.
Understand telemetry governance.
Design secure log pipelines.
Build immutable logging solutions.
Protect audit evidence.
Define enterprise log-retention policies.
Design log-encryption strategies.
Understand compliance logging.
Design cross-account log aggregation.
Prepare enterprise environments for monitoring, threat detection and incident response.

📚 Lesson Information

Area	Details
Estimated Time	6–7 Hours
Difficulty	Advanced
Prerequisites	Lesson 01 – Enterprise Security Operations
Hands-on Labs	Yes
Primary Roles	Cloud Security Engineer, SOC Analyst, Security Architect, Incident Responder
Enterprise Scenario	CloudNova Technologies

💼 Business Scenario

CloudNova Technologies has recently established its Enterprise Security Operations Centre (SOC).

The organisation currently operates:

500 AWS Accounts
12 AWS Regions
25 Production Applications
Multiple Development Environments
Dedicated Security Tooling Account
Dedicated Log Archive Account (planned)
PCI DSS workloads
HIPAA workloads
ISO 27001 certified environments
SOC 2 compliant systems
GDPR regulated customer data

Although security monitoring tools have been deployed, logging practices remain inconsistent across business units.

Current challenges include:

CloudTrail logs stored separately in workload accounts.
Different log-retention periods across applications.
No enterprise log-classification standard.
Developers can access security logs.
No immutable audit evidence.
Log integrity is not verified.
Missing application logging standards.
Duplicate telemetry across monitoring platforms.
No central ownership of logging.
SIEM receives incomplete security telemetry.
Unknown storage costs.
Limited visibility during investigations.

A recent internal audit concluded:

“CloudNova cannot guarantee that security evidence collected today would remain complete, trustworthy and admissible during a future forensic investigation.”

The Chief Information Security Officer (CISO) asks:

“How do we design a logging architecture that provides complete visibility, trustworthy evidence and enterprise governance across every AWS account?”

As CloudNova’s Cloud Security Architect, your objective is to design a secure, scalable and compliant logging strategy for the organisation.

1. Why Enterprise Logging Matters

Logging is one of the most important security controls within AWS.

Without reliable logs, organisations cannot:

Detect attacks.
Investigate incidents.
Meet compliance requirements.
Perform forensic analysis.
Understand user behaviour.
Troubleshoot security issues.
Validate security controls.
Prove regulatory compliance.

Logging provides the historical evidence needed to understand what happened before, during and after a security event.

2. Logging vs Monitoring

Logging and monitoring are closely related but serve different purposes.

Logging	Monitoring
Records activity	Observes activity
Historical evidence	Real-time visibility
Supports investigations	Supports detection
Used for audits	Used for alerting
Stores raw telemetry	Generates operational insights

Monitoring depends on high-quality logging.

Poor logging results in poor monitoring.

3. What is Security Telemetry?

Security telemetry is the collection of security-relevant data generated by cloud resources, applications and users.

Security telemetry enables organisations to:

Detect threats.
Monitor behaviour.
Identify policy violations.
Investigate incidents.
Improve security controls.

Think of telemetry as the “digital footprint” of everything happening inside an AWS environment.

4. Types of Security Telemetry

CloudNova collects telemetry from multiple layers of its AWS environment.

Layer	Examples
Identity	IAM, STS, Identity Center
Network	VPC Flow Logs, Route 53 Resolver Logs
Compute	EC2, ECS, EKS
Serverless	AWS Lambda
Storage	Amazon S3
Database	Amazon RDS, DynamoDB
Application	Web Servers, APIs
Containers	Kubernetes Audit Logs
Security Services	GuardDuty, Security Hub
Configuration	AWS Config
Infrastructure	CloudTrail
Compliance	AWS Config Rules

Every telemetry source contributes to the organisation’s overall security visibility.

5. Enterprise Logging Principles

CloudNova defines the following logging principles.

Complete

Collect all relevant security events.

Accurate

Ensure timestamps, identities and event details are reliable.

Centralised

Store enterprise logs in dedicated security accounts.

Protected

Restrict access using least privilege.

Immutable

Prevent unauthorised modification or deletion.

Encrypted

Encrypt logs both in transit and at rest.

Searchable

Support efficient investigations.

Cost Optimised

Balance retention requirements with storage costs.

Compliant

Meet regulatory obligations.

6. Enterprise Logging Objectives

CloudNova’s logging strategy supports:

Security monitoring
Threat detection
Incident response
Digital forensics
Compliance
Risk management
Governance
Business continuity

Logging is not simply an operational requirement—it is a critical security capability.

7. Enterprise Logging Architecture

CloudNova’s target architecture is shown below.

AWS Accounts

↓

CloudTrail

↓

CloudWatch Logs

↓

AWS Config

↓

GuardDuty

↓

VPC Flow Logs

↓

Application Logs

↓

Central Log Archive Account

↓

Amazon Security Lake

↓

Enterprise SIEM

↓

Security Operations Centre

This architecture separates log collection, storage and analysis from production workloads.

8. Why Centralised Logging?

Storing logs inside workload accounts creates several risks.

If an attacker compromises an account, they may:

Delete logs.
Modify evidence.
Disable logging.
Remove CloudTrail trails.
Hide malicious activity.

Centralising logs provides:

Better security
Stronger governance
Easier investigations
Reduced operational complexity
Consistent retention policies

9. Enterprise Log Sources

CloudNova collects logs from many AWS services.

Identity

IAM
STS
IAM Identity Center

Infrastructure

AWS CloudTrail
AWS Config
AWS Organizations

Network

VPC Flow Logs
AWS WAF
Route 53 Resolver
CloudFront

Compute

Amazon EC2
ECS
EKS
Lambda

Storage

Amazon S3
Amazon EBS
Amazon EFS

Database

Amazon RDS
Aurora
DynamoDB

Security Services

GuardDuty
Security Hub
Inspector
IAM Access Analyzer

Encryption

AWS KMS
Secrets Manager

10. Log Classification

CloudNova classifies logs into several categories.

Category	Purpose
Security Logs	Detect attacks
Audit Logs	Regulatory compliance
Infrastructure Logs	Resource activity
Application Logs	Application troubleshooting
Access Logs	User access tracking
Compliance Logs	Policy validation
Diagnostic Logs	System troubleshooting

Proper classification helps determine retention and access requirements.

11. Log Ownership

Every log source must have a clearly defined owner.

Typical ownership model:

Log Type	Owner
CloudTrail	Cloud Security
GuardDuty	SOC
VPC Flow Logs	Network Team
Application Logs	Application Team
Database Logs	Database Team
Security Hub	SOC

Ownership ensures accountability for log quality and availability.

12. Dedicated Log Archive Account

CloudNova uses a dedicated AWS account to store enterprise security logs.

Benefits include:

Separation from production workloads.
Reduced risk of tampering.
Simplified compliance.
Centralised governance.
Consistent retention.
Easier investigations.

No production workloads should run inside the Log Archive account.

13. Security Telemetry Governance

Governance ensures logging remains effective over time.

CloudNova governs:

Log ownership
Naming standards
Classification
Retention
Encryption
Access control
Cost management
Integrity validation
Availability
Periodic reviews

14. Log Naming Standards

Example standard:

<BusinessUnit>-<Environment>-<Service>-<Region>-<Purpose>

Example:

Finance-Production-CloudTrail-ap-south-1-Audit

Consistent naming improves searchability and automation.

15. Log Retention Strategy

CloudNova defines four retention tiers.

Tier	Purpose
Hot	Active investigations
Warm	Operational monitoring
Cold	Long-term storage
Archive	Regulatory evidence

Retention periods should align with:

Business needs
Legal obligations
Compliance standards
Storage costs

16. Log Integrity

Security logs are valuable evidence.

CloudNova protects log integrity through:

Hash validation
CloudTrail Log File Validation
S3 Object Lock
Versioning
Encryption
Restricted access

Logs should be treated as digital evidence.

17. Immutable Storage

Critical security logs should be protected from deletion.

CloudNova uses:

Amazon S3 Object Lock
Versioning
MFA Delete (where applicable)
Least privilege
Backup replication

Immutable storage prevents attackers from destroying evidence.

18. Log Encryption

Enterprise logs must always be encrypted.

Encryption includes:

Encryption at Rest
Encryption in Transit
Customer Managed KMS Keys
Cross-account encryption

Sensitive security telemetry should never be stored unencrypted.

19. Evidence Preservation

Logs often become digital evidence during investigations.

CloudNova follows these principles:

Preserve original logs.
Restrict access.
Maintain chain of custody.
Prevent modification.
Record evidence handling.

Evidence preservation supports legal and regulatory investigations.

20. Compliance Logging

CloudNova’s logging strategy supports:

PCI DSS
HIPAA
ISO 27001
SOC 2
GDPR
NIST Cybersecurity Framework
CIS Benchmarks

Different regulations require different retention periods and audit evidence.

21. Logging Threat Model

Potential threats include:

Logging disabled
CloudTrail deleted
Log modification
Log deletion
Insider tampering
Unencrypted storage
Misconfigured permissions
Cross-account exposure

Understanding these risks helps design resilient logging architectures.

22. Enterprise Logging Lifecycle

Generate Logs

↓

Collect Logs

↓

Encrypt

↓

Transfer Securely

↓

Centralise

↓

Validate Integrity

↓

Store

↓

Monitor

↓

Archive

↓

Delete Securely

🛠 Enterprise Labs

Lab 01 – Assess Existing Logging Architecture

Lab 02 – Design a Central Log Archive Account

Lab 03 – Classify Enterprise Security Telemetry

Lab 04 – Build an Enterprise Logging Architecture

Lab 05 – Configure Secure S3 Storage for Logs

Lab 06 – Design Log Retention Policies

Lab 07 – Design KMS Encryption Strategy

Lab 08 – Create Evidence Preservation Procedures

Lab 09 – Develop Logging Governance Standards

Lab 10 – Enterprise Logging Architecture Assessment

💻 AWS Console Walkthrough

Review the following services:

AWS Organizations
Amazon S3
AWS KMS
CloudTrail (architecture overview)
CloudWatch Logs
AWS Config
Security Hub
Amazon Security Lake

💻 AWS CLI Exercises

# Display organisation information
aws organizations describe-organization

# Review S3 bucket versioning
aws s3api get-bucket-versioning \
  --bucket cloudnova-log-archive

# Review Object Lock configuration
aws s3api get-object-lock-configuration \
  --bucket cloudnova-log-archive

# List KMS keys
aws kms list-keys

# Describe a KMS key
aws kms describe-key \
  --key-id alias/cloudnova-log-key

# List CloudTrail trails
aws cloudtrail describe-trails

# List CloudWatch log groups
aws logs describe-log-groups

# Review AWS Config recorders
aws configservice describe-configuration-recorders

✅ Verification Checklist

You should now be able to:

Explain enterprise logging principles.
Define security telemetry.
Design a centralised logging architecture.
Classify enterprise log sources.
Design a Log Archive Account.
Explain log-retention strategies.
Protect log integrity.
Design immutable storage.
Secure logs using encryption.
Build an enterprise telemetry governance framework.

🏢 Enterprise Best Practices

CloudNova standards include:

Centralise all security logs.
Encrypt logs with customer-managed KMS keys.
Apply least privilege to log access.
Enable immutable storage for critical audit evidence.
Standardise naming and classification.
Monitor logging health continuously.
Define ownership for every telemetry source.
Review retention policies annually.

🚫 Common Mistakes

Keeping logs only in workload accounts.
Allowing developers unrestricted access to security logs.
Using inconsistent retention periods.
Ignoring log integrity validation.
Disabling encryption.
Failing to classify telemetry.
Not monitoring log-delivery failures.

🧪 DIY Enterprise Challenge

Design a complete enterprise logging strategy for CloudNova supporting:

500 AWS accounts
Multi-Region operations
Central Log Archive account
PCI DSS
HIPAA
Security Lake
Enterprise SIEM
Immutable storage
Cross-account encryption
Executive governance

Prepare:

Logging architecture
Telemetry catalogue
Retention policy
Evidence-preservation standard
Access-control model
Governance framework
Cost-optimisation strategy
Executive implementation roadmap

📊 Knowledge Check

Create and answer the following questions:

What is enterprise logging?
Why is security telemetry important?
How does logging differ from monitoring?
What are the primary enterprise log sources?
Why should logs be centralised?
What is a Log Archive Account?
Why is log integrity important?
What is immutable storage?
Why encrypt security logs?
How does logging support compliance?
What is evidence preservation?
What are common logging threats?
Why classify logs?
What factors influence retention policies?
Why assign log ownership?
What is telemetry governance?
How should enterprise logs be named?
What are the benefits of Object Lock?
How do KMS keys protect logs?
Why should logging architecture be reviewed regularly?

💡 Key Takeaways

After completing this lesson, you should be able to:

Design enterprise logging strategies for AWS.
Build secure and centralised log architectures.
Protect security telemetry using encryption and immutable storage.
Establish governance, ownership and retention standards.
Prepare AWS environments for monitoring, threat detection, digital forensics and compliance.
Build a logging foundation that supports CloudTrail, CloudWatch, GuardDuty, Security Hub, Security Lake and enterprise SIEM platforms.

🚀 Next Lesson

➡️ Lesson 03 — AWS CloudTrail Enterprise Logging Architecture, Audit Trails & Organisation-Wide Governance