Examkin

Question

Difficulty: HardImproving Operational Excellence via Monitoring and Logging

An enterprise operates a financial transaction auditing application deployed on a fleet of Amazon EC2 instances. The application writes security-sensitive transaction logs to `/var/log/audit/transactions.log`. A local utility rotates these logs hourly by renaming the active log file to `transactions.log.YYYY-MM-DD-HH` and creating a new empty `transactions.log` file. The Unified CloudWatch Agent is installed on each EC2 instance and is configured to stream these logs to a central Amazon CloudWatch Logs log group in the application account.

A subscription filter on the CloudWatch log group forwards all incoming log events to an Amazon Kinesis Data Firehose delivery stream. This stream is responsible for delivering the logs to an Amazon S3 bucket located in a centralized Logging AWS account for long-term retention and compliance audits.

During a post-deployment verification phase, the solutions architect identifies two distinct operational issues:
1. Log ingestion from the EC2 instances halts within the first hour of log rotation and does not resume automatically.
2. The Kinesis Data Firehose delivery stream fails to write any records to the centralized S3 bucket in the Logging account.

Which combination of actions will resolve both issues while adhering to the principle of least privilege?

  1. A
    Modify the Unified CloudWatch Agent configuration file on the EC2 instances to use the static path `/var/log/audit/transactions.log`, and configure a cron job to restart the agent service immediately after each hourly log rotation. In the Logging AWS account, modify the Amazon S3 bucket policy to grant `s3:PutObject` permissions to the IAM role assumed by the Kinesis Data Firehose delivery stream, without using a canned ACL.
  2. B
    Update the Unified CloudWatch Agent configuration file on the EC2 instances to set the `file_path` parameter to `/var/log/audit/transactions.log*`. In the Logging AWS account, modify the destination Amazon S3 bucket policy to grant `s3:PutObject` and `s3:PutObjectAcl` permissions to the root principal of the application account (`arn:aws:iam::Application-Account-ID:root`), allowing Kinesis Data Firehose to write to the bucket by inheriting these permissions.
  3. Update the Unified CloudWatch Agent configuration file on the EC2 instances to set the `file_path` parameter to `/var/log/audit/transactions.log*`. In the Logging AWS account, modify the destination Amazon S3 bucket policy to grant `s3:PutObject` and `s3:PutObjectAcl` permissions to the specific IAM role assumed by the Kinesis Data Firehose delivery stream, and configure the Kinesis Data Firehose stream to write objects using the `bucket-owner-full-control` canned ACL.Answer
  4. D
    Modify the Unified CloudWatch Agent configuration file on the EC2 instances to use the static path `/var/log/audit/transactions.log`. In the Logging AWS account, configure the destination Amazon S3 bucket policy to grant the AWS service principal `firehose.amazonaws.com` permissions to perform `s3:PutObject` operations on the bucket without specifying any IAM role or account condition.

Answer

Use a wildcard path in the CloudWatch Agent configuration to monitor rotated log files, grant S3 permissions to the specific Kinesis Data Firehose IAM role in the bucket policy, and configure the stream with the bucket-owner-full-control canned ACL.
The correct solution uses a wildcard pattern in the CloudWatch Agent configuration to monitor rotated log files natively. For cross-account S3 delivery, Kinesis Data Firehose must assume an IAM role that is explicitly granted permissions in the destination S3 bucket policy. The bucket policy must allow both the `s3:PutObject` and `s3:PutObjectAcl` actions. Additionally, Kinesis Data Firehose must be configured with the `bucket-owner-full-control` canned ACL so that the destination Logging account becomes the owner of the written log files.

Step-by-Step Solution

1
Update the CloudWatch Agent's configuration file on the EC2 instances.
The `file_path` parameter is set to `/var/log/audit/transactions.log*` instead of a static path.
This allows the agent to continuously monitor the active file and recognize rotated log files (e.g., `transactions.log.2026-07-16-11`) without requiring a service restart.
2
Configure cross-account permissions on the Logging account's S3 bucket policy.
A policy is attached to the bucket that explicitly allows the `s3:PutObject` and `s3:PutObjectAcl` actions for the Kinesis Data Firehose IAM role ARN from the application account.
Kinesis Data Firehose uses its configured IAM role to write to the destination S3 bucket. The bucket policy must explicitly trust this role to authorize the cross-account write.
3
Enable the `bucket-owner-full-control` canned ACL on the Kinesis Data Firehose stream configuration.
Firehose writes objects with metadata specifying that the bucket owner has full control.
Without this ACL, the application account remains the owner of the uploaded log objects, preventing the destination logging account from viewing or managing them.

Key Concept

Implementing robust cross-account log aggregation with Kinesis Data Firehose and managing CloudWatch agent configuration for rotated log files.
Rate this question

Topics

Improving Operational Excellence via Monitoring and Logging