Which AWS Storage option is ideal for storing incident response related artifacts and logs?

Amazon Simple Storage Service (S3) is the ideal choice for storing incident response artifacts and logs. It is a highly durable (99.999999999%), scalable, and cost-effective object storage service designed for unstructured data. S3 provides critical features for evidence handling, such as versioning to preserve object history and Object Lock for write-once, read-many (WORM) protection to ensure data immutability. Furthermore, its storage tiering capabilities (e.g., S3 Glacier, S3 Glacier Deep Archive) allow for cost-efficient, long-term archival of evidence and logs, which is a common requirement for compliance and forensic retention policies.

A. Elastic File Store: EFS is a shared file system (NFS) for EC2 instances. It is optimized for active, concurrent access and is more expensive than S3 for archival purposes.
B. ElastiCache: This is a volatile, in-memory caching service used to improve application performance. It is not a persistent or durable storage solution and is unsuitable for storing evidence.
C. Elastic Block Storage: EBS provides block-level storage volumes for a single EC2 instance, akin to a virtual hard drive. It is not designed as a centralized, scalable repository for artifacts.

1. AWS Whitepaper, AWS Security Incident Response Guide, June 2020.

Page 22, "Preparation - Logging and monitoring": This section explicitly recommends centralizing logs from various sources (e.g., CloudTrail, VPC Flow Logs, DNS logs) into an Amazon S3 bucket for analysis and retention.

Page 18, "Containment - Isolate": The guide describes taking snapshots of EBS volumes of compromised instances. These snapshots are stored and managed within Amazon S3, underscoring its role as the underlying repository for forensic artifacts.

2. AWS Documentation, Amazon S3 Use Cases.

Section: "Backup and archive for data": The official documentation highlights S3's suitability for "long-term data archive at the lowest cost," mentioning S3 Glacier and S3 Glacier Deep Archive. This directly aligns with the need for retaining incident response artifacts for extended periods.

3. AWS Documentation, Protecting data with Amazon S3 Object Lock.

This document details how S3 Object Lock can enforce retention policies in a WORM model, stating it can "help you meet regulatory requirements... or simply add another layer of protection against object changes and deletion." This feature is critical for maintaining the integrity of forensic evidence.