Examkin

Question

Difficulty: HardImproving Operational Excellence via Monitoring and Logging

A healthcare provider runs a legacy patient management portal on Amazon EC2 instances managed by an Auto Scaling group across multiple member accounts in an AWS Organization. The portal's web server writes diagnostic audit logs to `/var/log/portal/audit.log`. The portal uses an automated hourly log rotation utility that renames the active file to `/var/log/portal/audit.log.YYYYMMDD-HH` and creates a new empty `/var/log/portal/audit.log` file. The company must centralize these rotated logs in near real-time into an Amazon S3 bucket located in a dedicated Auditing AWS account. The S3 bucket is configured with default encryption using an AWS Key Management Service (AWS KMS) customer managed key (CMK) to comply with health regulations. The logs must first be captured via CloudWatch Logs in each member account and then streamed to the centralized S3 bucket using Amazon Kinesis Data Firehose. Which two actions should the Solutions Architect take to implement this logging architecture while ensuring operational continuity during log rotation and adhering to the principle of least privilege?

  1. Configure the CloudWatch agent on the EC2 instances by specifying the file path as `/var/log/portal/audit.log*` in the agent configuration file to ensure both active and rotated logs are collected.Answer
  2. Configure Kinesis Data Firehose in each member account to deliver logs to the Auditing account's S3 bucket. Update the S3 bucket policy in the Auditing account to grant `s3:PutObject` permissions to the Firehose IAM role ARN from each member account, and update the KMS CMK policy in the Auditing account to grant `kms:GenerateDataKey` permissions to the same roles.Answer
  3. C
    Configure the CloudWatch agent on the EC2 instances by specifying the static file path as `/var/log/portal/audit.log` in the agent configuration file, relying on the agent's file descriptor tracking to capture rotated files.
  4. D
    Configure Kinesis Data Firehose in each member account to write to the S3 bucket using the AWS-managed KMS key `aws/s3` for encryption, and grant the wildcard principal `*` cross-account access via the S3 bucket policy.
  5. E
    Configure the S3 bucket policy in the Auditing account to allow cross-account writes from the member accounts' roles, but omit modifications to the KMS key policy, relying on S3 bucket key encryption to automatically authorize cross-account write requests.

Answer

To implement this architecture successfully, the Solutions Architect must configure the CloudWatch agent with a wildcard path pattern to track rotated files, configure Kinesis Data Firehose to stream the logs, and update both the S3 bucket policy and the KMS customer managed key policy in the Auditing account to allow permissions to the Kinesis Data Firehose roles from the member accounts.
The correct options involve configuring the CloudWatch agent on the EC2 instances with a wildcard path to monitor rotated files, and configuring Kinesis Data Firehose with the required permissions in the Auditing account. The Auditing account's S3 bucket policy must allow writing from the member accounts' Firehose IAM roles, and the customer managed KMS key policy must grant key generation permissions to those same roles to allow encryption of logs upon delivery.

Step-by-Step Solution

1
Configure the CloudWatch agent config file to use a wildcard pattern for log path tracking.
Ensures that when log rotation occurs hourly and renames the file, the agent continues to read the rotated log and begins reading the new log file without duplicate delivery or log loss.
A static path will only monitor the active file and fail to capture data that was in the process of being sent or rotated, or fail when the file handle changes.
2
Configure cross-account permissions on the destination S3 bucket in the Auditing account.
Allows Kinesis Data Firehose roles in the member accounts to write log files directly to the S3 bucket.
S3 buckets do not allow cross-account writes by default; a bucket policy must explicitly permit write permissions for the specific IAM role principals.
3
Configure cross-account permissions on the KMS Customer Managed Key policy in the Auditing account.
Allows Kinesis Data Firehose to generate data keys for encrypting objects during delivery.
Because the S3 bucket is encrypted with a customer managed key, the writing IAM role must have key generation permissions on the key policy. AWS-managed keys cannot be modified and thus cannot support this cross-account configuration.

Key Concept

Aggregating rotated application logs across multiple AWS accounts to a centralized, KMS-encrypted S3 bucket using CloudWatch Agent and Kinesis Data Firehose under the principle of least privilege.
Rate this question

Topics

Improving Operational Excellence via Monitoring and Logging