Examkin

Question

Difficulty: HardImproving Operational Excellence via Monitoring and Logging

A logistics enterprise uses AWS Organizations to manage a multi-account environment. The production application runs on a fleet of Amazon EC2 instances in a production account. The application logs are written to `/var/log/app/production-active.log` and are rotated hourly by renaming the active file to `/var/log/app/production-YYYYMMDD-HH.log` before creating a new active log file. The enterprise also wants to centralize AWS CloudTrail logs from all organization accounts into an Amazon S3 bucket in a dedicated Logging account. A Solutions Architect is tasked with designing a highly secure, reliable logging architecture that ensures zero log loss for the application logs during rotation and successful centralized delivery of CloudTrail logs. Which combination of configurations should the Solutions Architect implement?

  1. A
    Configure the Unified CloudWatch Agent on the EC2 instances with the log file path set to `/var/log/app/production-active.log`. In the Logging account, configure the S3 bucket policy to grant `s3:PutObject` permissions to the AWS Organizations principal (`organizations.amazonaws.com`) and include a condition checking that the `aws:PrincipalOrgID` matches the organization's ID.
  2. B
    Configure the Unified CloudWatch Agent on the EC2 instances with the log file path set to `/var/log/app/production-active.log`. In the Logging account, configure the S3 bucket policy to grant `s3:PutObject` permissions to the IAM roles of all member accounts in the organization, using a wildcard for the IAM principal ARN.
  3. Configure the Unified CloudWatch Agent on the EC2 instances with the log file path set to `/var/log/app/production-*.log`. In the Logging account, configure the S3 bucket policy to grant `s3:PutObject` permissions to the CloudTrail service principal (`cloudtrail.amazonaws.com`) and include a condition checking that the `aws:PrincipalOrgID` matches the organization's ID.Answer
  4. D
    Configure the Unified CloudWatch Agent on the EC2 instances with the log file path set to `/var/log/app/production-*.log`. In the Logging account, configure the S3 bucket policy to grant `s3:PutObject` permissions to the CloudTrail service principal (`cloudtrail.amazonaws.com`) but omit any organizational condition, relying on the CloudTrail service to restrict access by default.

Answer

Configure the Unified CloudWatch Agent with a wildcard path pattern and configure the S3 bucket policy to authorize the CloudTrail service principal restricted by the organization ID.
The correct option addresses both requirements securely and reliably. By using a wildcard pattern `/var/log/app/production-*.log` in the Unified CloudWatch Agent configuration, the agent monitors all matching logs including the active and newly rotated files, preventing log loss during rotation. For centralized auditing, the S3 bucket policy correctly identifies the CloudTrail service principal (`cloudtrail.amazonaws.com`) and secures access by checking the `aws:PrincipalOrgID` condition to ensure only member accounts write to the bucket.

Step-by-Step Solution

1
Address the log rotation behavior of the application on the EC2 instances.
The Solutions Architect must specify a wildcard path (`/var/log/app/production-*.log`) in the CloudWatch Agent configuration.
This allows the agent to monitor both the active and renamed log files, ensuring the agent reads the remaining contents of the rotated file before it is archived or deleted.
2
Define the target IAM policy principal for the centralized S3 bucket in the Logging account.
The policy must target the CloudTrail service principal (`cloudtrail.amazonaws.com`).
CloudTrail is the service responsible for delivering the audit logs across all accounts in the organization.
3
Implement cross-account organizational security boundaries in the S3 bucket policy.
Incorporate the `aws:PrincipalOrgID` condition key matching the organization's ID.
This restricts write access to the S3 bucket to only the trails originating from accounts within the specific organization.

Key Concept

Ensuring operational log integrity during rotation and configuring secure centralized cross-account logging boundaries.
Rate this question

Topics

Improving Operational Excellence via Monitoring and Logging