Send Secrets Manager events to CloudWatch Logs, add an IncomingBytes metric filter with anomaly detection, and alarm to SNS
Short answer
C Route Secrets Manager events to CloudWatch Logs, add a metric filter with anomaly detection on IncomingBytes, and alarm to SNS.
Question
Key Takeaways
The path is EventBridge → CloudWatch Logs → metric filter (IncomingBytes) with anomaly detection → CloudWatch alarm → SNS (C). CloudTrail is the event source, not the rule target (A/B are wrong—CloudTrail is not an EventBridge target). D uses Logs Insights queries rather than the metric-filter+anomaly-detection+alarm pipeline the question describes. C is correct.
An EventBridge rule already catches Secrets Manager events from CloudTrail. To alert on anomalous GetSecretValue volume, set CloudWatch Logs as the rule target, add a metric filter on the IncomingBytes field with CloudWatch anomaly detection enabled, and create a CloudWatch alarm on that metric that notifies an SNS topic. The anomaly detection surfaces unusual call volume without manual thresholds.
Common mistake: Setting CloudTrail as the EventBridge target (A/B)—CloudTrail is the source of the events delivered to EventBridge, not a target of the rule. Using Logs Insights queries (D)—that is ad-hoc search, not the metric-filter plus anomaly-detection alarm the requirement describes. The CloudWatch Logs metric filter with anomaly detection (C) is the documented feature.
Expert Analysis
Why the Answer Is Correct
With the EventBridge rule already capturing Secrets Manager CloudTrail events, the notification pipeline is: target CloudWatch Logs, create a metric filter on the IncomingBytes metric, enable CloudWatch anomaly detection on that filter, and attach a CloudWatch alarm that publishes to an SNS topic. Anomaly detection automatically flags unusual GetSecretValue volume and the alarm emails the notification—exactly the requirement.
Why the Other Options Are Wrong
A and B set CloudTrail as the EventBridge rule target, but CloudTrail is the event source, not a target; the rule should target CloudWatch Logs. D uses Logs Insights query syntax instead of the metric-filter plus anomaly-detection alarm pipeline the question specifies. C is the correct, built-in approach.
Community Comment Notes
Community voted C (100). Commenters described using CloudWatch's built-in anomaly detection on the logged volume (IncomingBytes) via a metric filter and SNS alarm, noting this feature was little-known but purpose-built. C confirmed.
Official Reference
This link opens the official vendor documentation in a new tab.
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
IPLogic 👍 1 Answered CC. Configure Amazon CloudWatch Logs as the target of the EventBridge rule. Set up a metric filter on the IncomingBytes metric and enable anomaly detection. Create an Amazon Simple Notification Service (Amazon SNS) topic. Configure a CloudWatch alarm that uses the SNS topic to send the notification. EventBridge Rule and CloudWatch Logs: By configuring CloudWatch Logs as the target of the EventBridge rule, you can capture and store all relevant logs for further analysis. Metric Filter and Anomaly Detection: Setting up a metric filter on the IncomingBytes metric enables detailed monitoring and anomaly detection for specific API call patterns, such as the GetSecretValue API. SNS Topic for Notifications: Creating an SNS topic ensures that alerts are sent out immediately when an anomaly is detected. CloudWatch alarms can be configured to trigger notifications via SNS, providing timely alerts to the security team.
-
723993f 👍 1 Answered CC - using built-in anomaly detection in cloudwatch based on the volume of "what is being logged itself" https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Monitoring-CloudWatch-Metrics.html#cwl-metrics https://medium.com/cyberark-engineering/unlocking-the-power-of-amazon-cloudwatch-anomaly-detection-for-secrets-manager-27a7ffd66498
-
TareDHakim 👍 1 Answered Camazing feature, which I had no idea existed.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.