Earlier in this chapter, I mentioned the significance of logs and the part they play in IR. During an incident, it's critical that you are able to access your logs and that you know the process and methods for extracting and searching for data within them. You must be able to look at, for example, an S3 access log or AWS CloudTrail log and understand the syntax, parameters, and fields that are presented in order to process the information being shown. You may have third-party tools to do this analysis for you, but if you don't have access to those systems for any reason, you need to be able to decipher the logs manually.
If you have multiple AWS accounts, determine which ones can be shared with other accounts. To help with log sharing, you should configure cross-account data sharing with the use of CloudWatch and Amazon Kinesis. Cross-account data sharing allows you to share log data between multiple accounts that can then read it from a centralized...