An enterprise runs a critical banking application on Amazon EC2 instances across multiple AWS accounts within an organization in AWS Organizations. The application outputs transactional logs to `/var/log/app/transaction.log`, which is rotated hourly to `/var/log/app/transaction.log.YYYY-MM-DD-HH` and compressed. The security team requires centralizing these logs into a single Amazon S3 bucket in a dedicated logging account. A Solutions Architect deployed the unified Amazon CloudWatch agent on the EC2 instances to stream these logs to Amazon CloudWatch Logs, but notices that logs are regularly lost immediately after the hourly rotation occurs. Which of the following solutions resolves this issue and achieves centralized collection securely?
- Configure the CloudWatch agent configuration file log path to use a wildcard pattern `/var/log/app/transaction.log*` to match rotated files. Create an Amazon Kinesis Data Firehose delivery stream in each application account to send logs to the centralized S3 bucket, and update the S3 bucket policy in the logging account to permit `firehose.amazonaws.com` with the organization ID condition.Answer
- BConfigure the CloudWatch agent configuration file log path specifically to `/var/log/app/transaction.log`. Create an Amazon Kinesis Data Firehose delivery stream in each application account to send logs to the centralized S3 bucket, and update the S3 bucket policy in the logging account to permit `firehose.amazonaws.com` with the organization ID condition.
- CConfigure the CloudWatch agent configuration file log path to use a wildcard pattern `/var/log/app/transaction.log*` to match rotated files. Create an Amazon Kinesis Data Firehose delivery stream in each application account to send logs to the centralized S3 bucket, and update the S3 bucket policy in the logging account to allow universal write access using a wildcard principal.
- DConfigure the CloudWatch agent configuration file log path specifically to `/var/log/app/transaction.log`. Create a cross-account IAM role in each application account that grants the CloudWatch agent direct permissions to write to the centralized S3 bucket in the logging account.
Answer
Configure the CloudWatch agent configuration file log path to use a wildcard pattern to match rotated files, use Kinesis Data Firehose to stream to the centralized S3 bucket, and restrict the S3 bucket policy to the organization ID.
The correct option addresses the agent limitation by replacing the static log path with a wildcard pattern, allowing the agent to continuously monitor rotated files. It then leverages Kinesis Data Firehose to securely stream logs across accounts into a centralized S3 bucket, utilizing the Organization ID condition in the bucket policy to restrict access to trusted internal accounts.
Step-by-Step Solution
Key Concept
Configuring the CloudWatch agent log path with wildcards to handle log rotation, combined with secure cross-account centralization via S3 bucket policies constrained by Organization ID.