An enterprise runs a critical trading application on Amazon EC2 instances in an Auto Scali… — AWS Certified Solutions Architect - Professional

An enterprise runs a critical trading application on Amazon EC2 instances in an Auto Scaling group. The application writes transaction logs directly to a local directory `/var/log/trading/`. Due to high transaction volumes, the application does not write to a static file; instead, it writes directly to new hourly log files named in the format `/var/log/trading/trade_YYYYMMDD_HH.log` (for example, `/var/log/trading/trade_20260716_11.log`).

A solutions architect must design a centralized logging solution to stream these logs to Amazon CloudWatch Logs, and then forward them to an Amazon S3 bucket in a centralized security account ( $111122223333$ ) using Amazon Kinesis Data Firehose. The solution must ensure that log delivery is continuous, handles the hourly file creation without missing data, and respects the principle of least privilege.

Which configuration strategy must the solutions architect implement to meet these requirements?

A
Configure the CloudWatch agent on the EC2 instances with the log path set to `/var/log/trading/trade_*.log`. In the security account ( $111122223333$ ), configure the S3 bucket policy to grant `s3:PutObject` and `s3:GetBucketLocation` permissions to the AWS service principal `firehose.amazonaws.com` with a condition pattern matching the application account ID.
Configure the CloudWatch agent on the EC2 instances with the log path set to `/var/log/trading/trade_*.log`. In the security account ( $111122223333$ ), configure the S3 bucket policy to grant `s3:PutObject` and `s3:GetBucketLocation` permissions to the ARN of the IAM role assumed by the Kinesis Data Firehose delivery stream in the application account.Answer
C
Configure the CloudWatch agent on the EC2 instances with the log path set to `/var/log/trading/trade.log`. In the security account ( $111122223333$ ), configure the S3 bucket policy to grant `s3:PutObject` and `s3:GetBucketLocation` permissions to the ARN of the IAM role assumed by the Kinesis Data Firehose delivery stream in the application account.
D
Configure the CloudWatch agent on the EC2 instances with the log path set to `/var/log/trading/trade.log`. In the security account ( $111122223333$ ), configure the S3 bucket policy to grant `s3:PutObject` and `s3:GetBucketLocation` permissions to the AWS service principal `firehose.amazonaws.com` with a condition pattern matching the application account ID.

Answer

Configure the CloudWatch agent with a wildcard path (`/var/log/trading/trade_*.log`) and update the destination S3 bucket policy to trust the ARN of the Kinesis Data Firehose execution role.

The correct strategy requires configuring the CloudWatch agent with a wildcard path (`/var/log/trading/trade_*.log`) to ensure all newly created hourly logs are captured. Furthermore, to enable Kinesis Data Firehose to deliver these logs to a centralized S3 bucket in a separate AWS account, the target S3 bucket policy must allow `s3:PutObject` and `s3:GetBucketLocation` with the Principal set to the specific ARN of the Firehose delivery stream's IAM execution role. This satisfies both the dynamic log collection and the least-privilege security requirements.

Step-by-Step Solution

Configure the CloudWatch agent log path parameter with a wildcard to match the hourly logs.

The agent configuration matches `/var/log/trading/trade_*.log` instead of a static filename, enabling it to tail newly created hourly files.

Since the application writes directly to dynamically timestamped files, a static configuration will not match any active log files, preventing ingestion.

Create an IAM role for Kinesis Data Firehose in the application account and configure the delivery stream.

Firehose is set up to assume this role when executing delivery tasks.

Firehose uses the execution role to perform cross-account actions, such as writing objects to S3.

Configure the S3 bucket policy in the security account to trust the Firehose execution role ARN.

The bucket policy allows `s3:PutObject` and `s3:GetBucketLocation` for the specific principal ARN from the application account.

Cross-account access must be explicitly allowed by the resource policy of the target bucket, using the specific IAM principal executing the request.

Key Concept

Continuous log file collection via wildcard matching and secure cross-account S3 log centralization.

Estimated Time:2m 30s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics