Examkin

Question

Difficulty: HardImproving Operational Excellence via Monitoring and Logging

A financial technology company deploys a multi-tenant payment gateway application across multiple AWS accounts managed under a single organization in AWS Organizations. The application is hosted on Amazon EC2 instances within Auto Scaling groups. The application writes transaction events locally to /var/log/payment-app/transaction.log. A local script rotates these log files hourly by appending the current timestamp to the filename (e.g., transaction.log.2026-07-16-11) and creating a new empty transaction.log file.

To comply with audit regulations, all transaction logs must be aggregated in near real-time into a centralized Amazon S3 bucket located in a dedicated Security account. The logs must be encrypted at rest using a Customer Managed Key (CMK) in AWS KMS, and the architecture must prevent log loss or duplicate log ingestion.

Which combination of actions should a solutions architect take to meet these requirements? (Select TWO.)

  1. Configure the CloudWatch agent on the EC2 instances to monitor the log file using the static path /var/log/payment-app/transaction.log without wildcards, allowing the agent to automatically track file rotation using inodes.Answer
  2. Create an Amazon Kinesis Data Stream in the Security account, configure a centralized CloudWatch Logs destination that points to the stream, and create CloudWatch Logs subscription filters in the member accounts to forward the log events.Answer
  3. C
    Configure the CloudWatch agent on the EC2 instances to monitor the log files using the path /var/log/payment-app/transaction.log* with a wildcard to ensure that all rotated logs are explicitly matched and streamed during the hourly rotation transition.
  4. D
    Configure the central S3 bucket to use the default AWS-managed S3 key (aws/s3) for encryption at rest, and update the S3 bucket policy to allow the member account IAM roles to perform s3:PutObject operations.
  5. E
    Configure the CloudWatch agent to write log files directly to a shared Amazon EFS volume mounted across accounts, and configure AWS DataSync to copy the files to the centralized S3 bucket hourly.

Answer

The solutions architect should configure the CloudWatch agent to monitor the static log path /var/log/payment-app/transaction.log without wildcards, and set up an Amazon Kinesis Data Stream with cross-account CloudWatch Logs destinations and subscription filters.
To achieve operational excellence, the CloudWatch agent must be configured to watch the static active log file path. Since the agent tracks log files via file descriptor/inode, it automatically detects when a file is renamed (rotated) and continues reading it to the end while starting to read the new empty active file. This prevents both log loss and duplicate ingestion. For cross-account centralization, establishing a CloudWatch Logs destination in the Security account linked to a Kinesis Data Stream, and configuring subscription filters in the member accounts, is the standard real-time streaming pattern. Encryption with a Customer Managed Key (CMK) ensures that key policies can be customized to grant cross-account permissions.

Step-by-Step Solution

1
Configure the CloudWatch agent on the EC2 instances to point directly to the active log file /var/log/payment-app/transaction.log.
The agent will track the log file using its inode, ensuring that hourly log rotation is handled correctly without duplicate ingestion or log loss.
Specifying a wildcard pattern would cause the agent to re-read and upload rotated files, causing duplicates.
2
Create a central Amazon Kinesis Data Stream in the Security account to ingest the incoming log events.
A streaming entry point is created in the Security account to receive logs from all member accounts.
Kinesis Data Streams can ingest log streams from multiple cross-account sources at high throughput.
3
Configure a CloudWatch Logs destination in the Security account pointing to the Kinesis Data Stream and grant cross-account permissions via a destination policy.
A centralized destination is established that accepts subscription filters from member accounts within the AWS Organization.
A destination policy is required to authorize other AWS accounts to write to the Security account's log destination.
4
Set up CloudWatch Logs subscription filters in each member account's log group pointing to the central destination in the Security account.
Log events are streamed in near real-time from the local log groups to the central Security account.
Subscription filters are the standard and operationally excellent way to stream logs in real-time between AWS accounts.

Key Concept

Near real-time cross-account log centralization with CloudWatch agent file rotation handling and KMS key considerations.
Rate this question

Topics

Improving Operational Excellence via Monitoring and Logging