Examkin

Question

Difficulty: MediumMonitoring and Analyzing Logs with Amazon CloudWatch

A developer is troubleshooting an application deployed on Amazon ECS that writes logs to an Amazon CloudWatch Logs log group. The developer created a CloudWatch subscription filter to route log events containing the phrase `CRITICAL_ERROR` to an AWS Lambda function for real-time alerting. Although the developer verified that `CRITICAL_ERROR` is present in the log streams, the Lambda function is never invoked. Which two configurations or troubleshooting steps should the developer verify to resolve this issue?

  1. Verify that the resource-based policy of the target Lambda function allows the CloudWatch Logs service principal (`logs.amazonaws.com`) to perform the `lambda:InvokeFunction` action.Answer
  2. Confirm that the subscription filter pattern matches the exact casing of `CRITICAL_ERROR`, as CloudWatch Logs filter patterns are case-sensitive.Answer
  3. C
    Add `logs:GetLogEvents` and `logs:FilterLogEvents` permissions to the Lambda function's IAM execution role to allow the function to pull logs from the log group.
  4. D
    Ensure that an IAM trust policy is attached to the CloudWatch Logs log group allowing it to assume the Lambda function's execution role.
  5. E
    Increase the Lambda function's timeout configuration, because CloudWatch Logs subscription filter invocations fail silently if the execution duration exceeds 3 seconds.

Answer

Verify that the resource-based policy of the target Lambda function allows the CloudWatch Logs service principal to perform the invoke action, and confirm that the subscription filter pattern matches the exact casing of the error keyword, as CloudWatch Logs filter patterns are case-sensitive.
The correct options state that the Lambda resource-based policy must allow the CloudWatch Logs service principal to invoke the function, and that the filter pattern casing must be verified due to case sensitivity. CloudWatch Logs invokes Lambda asynchronously using a push model. For this invocation to succeed, the Lambda function must have a resource-based policy that explicitly allows 'logs.amazonaws.com' to call 'lambda:InvokeFunction'. Furthermore, CloudWatch subscription filters perform case-sensitive matching on term literals, meaning any casing mismatch will prevent matches and invocations.

Step-by-Step Solution

1
Analyze the log delivery model of CloudWatch subscription filters.
CloudWatch Logs uses a push-model to invoke target Lambda functions, which requires resource-based permissions on the target Lambda function.
Since CloudWatch Logs is initiating the invocation, it must have the lambda:InvokeFunction permission granted to logs.amazonaws.com in the Lambda resource-based policy.
2
Examine the filter pattern matching characteristics.
CloudWatch Logs filter patterns are case-sensitive when evaluating text patterns.
If the subscription filter pattern is defined with incorrect casing, it will not match the log messages containing 'CRITICAL_ERROR'.

Key Concept

CloudWatch Logs subscription filters push events to target destinations like AWS Lambda using resource-based policies for authorization, and evaluate log streams using case-sensitive pattern matching.
Rate this question

Topics

Monitoring and Analyzing Logs with Amazon CloudWatch

More questions from this topic