How to send Ec2 logs to S3 and then monitoring it using Cloudwatch

Question

I am going through a situation where i do not know which is the correct way and how to do it.

My Aim is :

ec2 Logs should be uploaded in S3 and logs should be reviewed and monitored using cloudwatch for any unwanted events.

Scenario 1:

1) Upload ec2 logs to s3 and then to cloudwatch for security review and monitoring

Scenario 2:

1) Upload ec2 logs to cloudwatch and send data then s3

Scenario 3:

1) Upload ec2 logs to both s3 and cloudwatch simultaneously

Please help me to achieve what is correct way.

Thanks & Regards

Answer 1

You can send the logs to cloudwatch and then use cloudwatch to upload them to S3. Check this solution: https://aws.amazon.com/blogs/mt/how-to-export-ec2-instance-execution-logs-to-an-s3-bucket-using-cloudwatch-logs-lambda-and-cloudformation/