Examkin

Question

Difficulty: MediumImproving Operational Excellence via Monitoring and Logging

A logistics company collects real-time vehicle telemetry data using a custom logging framework running on a fleet of Amazon EC2 instances in an Auto Scaling group. The logging framework rotates the log files hourly, renaming them using the pattern `/var/log/telemetry/telemetry-YYYY-MM-DD-hh.log`. The operations team wants to stream these logs to Amazon CloudWatch Logs using the CloudWatch agent, and then use Amazon Kinesis Data Firehose to deliver them to a centralized Amazon S3 bucket in a dedicated security account. Currently, logs are not appearing in the central S3 bucket after the first hour of EC2 instance launch. Which two actions should the solutions architect take to resolve the logging delivery failures and ensure operational excellence? (Select TWO.)

  1. Specify the log file path as `/var/log/telemetry/telemetry-*.log` in the CloudWatch agent configuration file to ensure the agent monitors and tracks the rotated log files.Answer
  2. Update the S3 bucket policy in the centralized security account to allow `s3:PutObject` permissions for the IAM role assumed by the Kinesis Data Firehose delivery stream in the application account.Answer
  3. C
    Specify the static path `/var/log/telemetry/telemetry-current.log` in the CloudWatch agent configuration and configure a cron job to restart the CloudWatch agent daemon every hour.
  4. D
    Attach a Service Control Policy (SCP) to the application account's Organizational Unit (OU) that grants `s3:PutObject` access to the centralized S3 bucket for all resources in the account.
  5. E
    Configure the destination S3 bucket to encrypt objects using the default AWS-managed KMS key (`aws/s3`) and grant the Kinesis Data Firehose IAM role permission to use this key for cross-account writes.

Answer

To resolve these issues, the solutions architect must configure the CloudWatch agent with a wildcard path (`/var/log/telemetry/telemetry-*.log`) to handle hourly rotated files, and update the S3 bucket policy in the centralized security account to allow `s3:PutObject` for the Kinesis Data Firehose IAM role.
The correct configurations involve using a wildcard pattern in the CloudWatch agent configuration file so that it tracks newly rotated files dynamically, and updating the destination S3 bucket policy to permit cross-account writes from the Kinesis Data Firehose IAM role.

Step-by-Step Solution

1
Diagnose the log file path tracking mechanism.
Determine that static file configurations fail to capture logs after files are rotated and renamed.
To ensure continuous log collection after files undergo rotation.
2
Configure wildcard matching in the CloudWatch agent.
Apply `/var/log/telemetry/telemetry-*.log` to the file path configuration of the CloudWatch agent.
Wildcards allow the agent's file reader to seamlessly track new files matching the pattern without needing agent restarts.
3
Establish cross-account S3 bucket write permissions.
Modify the target S3 bucket policy in the security account to explicitly allow the Firehose IAM role from the application account to write files.
Cross-account object delivery requires an explicit S3 bucket policy permission in the destination account because default IAM permissions do not traverse account boundaries.

Key Concept

Continuous operational logging requires handling dynamic log rotation paths on hosts and configuring explicit resource-based policies for secure cross-account log delivery.
Rate this question

Topics

Improving Operational Excellence via Monitoring and Logging