An enterprise runs a fleet of Amazon EC2 instances in multiple production AWS accounts. The instances host a telemetry processing application that writes logs to `/var/log/telemetry/telemetry.log`. These logs undergo hourly rotation and are renamed with a timestamp suffix (for example, `/var/log/telemetry/telemetry.log.20260716-11`). The company wants to centralize these logs in an Amazon S3 bucket inside a dedicated monitoring account, ensure no log messages are lost during rotation, and support real-time alerting for application errors. Which two actions should a solutions architect take to implement this architecture under the principle of least privilege? (Select two.)
- Configure the AWS Unified CloudWatch Agent on the EC2 instances using the wildcard pattern `/var/log/telemetry/telemetry.log*` in the agent configuration file to stream the logs to CloudWatch Logs.Answer
- In the monitoring account, create an Amazon Kinesis Data Firehose delivery stream that writes to the S3 bucket, and create a CloudWatch Logs destination pointing to this stream. Grant cross-account write permissions to the production accounts, and create CloudWatch Logs subscription filters in the production accounts to stream logs to this destination.Answer
- CConfigure the AWS Unified CloudWatch Agent on the EC2 instances using the static file path `/var/log/telemetry/telemetry.log` and rely on the agent's built-in file tracking to automatically detect and follow rotated timestamped files.
- DConfigure the S3 bucket policy in the monitoring account with an Allow statement for the principal '*' without any conditions, and set up a cron job on the EC2 instances to copy the rotated logs directly to the S3 bucket using the AWS CLI.
- EConfigure the AWS Unified CloudWatch Agent on the EC2 instances to stream log data directly to the centralized Amazon S3 bucket in the monitoring account using an IAM role with S3 write permissions.
Answer
To achieve operational excellence, configure the CloudWatch agent on the EC2 instances to monitor log files using a wildcard pattern such as `/var/log/telemetry/telemetry.log*` to avoid log loss during rotation. In addition, set up a cross-account CloudWatch Logs destination in the monitoring account that routes incoming streams to Kinesis Data Firehose and ultimately to the S3 bucket, and create subscription filters in the production accounts to forward the log groups to this centralized destination.
The correct approach is to use a wildcard pattern `/var/log/telemetry/telemetry.log*` in the CloudWatch agent configuration, which allows it to successfully capture files renamed during hourly rotation. For secure and real-time cross-account centralization, a CloudWatch Logs destination in the monitoring account must be paired with Kinesis Data Firehose and production-account subscription filters, adhering to least-privilege policies.
Step-by-Step Solution
Key Concept
Handling rotated logs with the CloudWatch Agent via wildcard paths and centralizing cross-account logs using CloudWatch Logs destinations and Kinesis Data Firehose.