An enterprise runs a critical application on Amazon EC2 instances within member accounts of an AWS Organization. The application writes logs to `/var/log/app/production.log`. These logs are rotated hourly and renamed using the pattern `/var/log/app/production.log-YYYYMMDD-HH`. The enterprise needs to centralize these logs into a single Amazon S3 bucket in a dedicated security account for long-term compliance auditing. Additionally, the solution must support real-time alerting in Amazon CloudWatch for specific error codes, ensure no logs are lost during hourly rotation, and minimize the local disk footprint in the member accounts.
Which combination of actions will meet these requirements? (Select TWO.)
- Configure the CloudWatch Agent on the EC2 instances to monitor the log path `/var/log/app/production.log*`. Implement a local log rotation utility to delete older rotated logs to free up disk space.Answer
- Configure a CloudWatch Logs subscription filter in each member account to stream logs to an Amazon Kinesis Data Firehose delivery stream in the same account. Grant the Firehose IAM role in each member account write permissions to the centralized S3 bucket, and configure the S3 bucket policy in the security account to permit these role ARNs.Answer
- CConfigure the CloudWatch Agent on the EC2 instances to monitor the static path `/var/log/app/production.log`. Rely on the CloudWatch Agent's auto-discovery feature to automatically track and stream renamed files after log rotation occurs.
- DConfigure the CloudWatch Agent on the EC2 instances to write log files directly to the centralized Amazon S3 bucket, and configure an S3 bucket policy in the security account that grants write access to all EC2 instances within the AWS Organization.
- EConfigure a local script on the EC2 instances to copy rotated log files directly to the centralized Amazon S3 bucket. Set up a lifecycle policy on the S3 bucket to transition the logs to S3 Glacier Deep Archive after 7 days.
Answer
To continuously collect logs during rotation and centralize them securely, the CloudWatch Agent must be configured with a wildcard pattern, and a CloudWatch Logs subscription filter must stream the logs to Kinesis Data Firehose to deliver them to the cross-account centralized S3 bucket.
Configuring the CloudWatch Agent with a wildcard path ensures that rotated logs are not missed. Using a subscription filter to stream logs to Kinesis Data Firehose allows for managed, secure delivery to a central S3 bucket in another account while maintaining logs in CloudWatch for real-time alerting.
Step-by-Step Solution
Key Concept
Continuous log ingestion with CloudWatch Agent wildcard pathing combined with cross-account centralized S3 log shipping using CloudWatch subscription filters.