Serverless aurora activity streams reference architecture design (DAM)

Question

Hi,

My customer is looking for an architecture to use the Aurora Database Activity Streams feature to provide some Database Activity Monitoring (DAM) capability.

They investigated the Imperva 3rd party offering, and concluded it didn't scale and they wanted something serverless using Kinesis and Lambda. Has anyone got experience with such a setup? My customer wants to know how to best build this and how much it would cost for a given number of invocations.

Their current envisaged setup is: DAS -> Kinesis Stream -> Kinesis Firehose -> S3 -> Lambda -> SNS (for alerts into Splunk).

Thanks

Accepted Answer

A potential (non-serverless) alternative would be:

DAS -> Kinesis -> Kinesis Firehose -> Splunk

(using the built-in Firehose sink for Splunk)

or

DAS -> Kinesis -> ELK (Elasticsearch)

(using this - https://github.com/guardian/elk-kinesis-logger)

You do need Splunk (or ELK) to do anything more complex than basic log analysis.

Serverless aurora activity streams reference architecture design (DAM)

Contenido relevante