Examkin

Question

Difficulty: MediumCentralized Monitoring, Logging, and Auditing Solutions

A company wants to consolidate application logs from Amazon CloudWatch Logs across multiple AWS accounts in an AWS Organization into a centralized Amazon S3 bucket located in a dedicated Security account. The security team wants to stream these logs in near-real-time using Amazon Kinesis Data Firehose in the Security account, and they need to ensure secure cross-account delivery. Which two steps must the solutions architect take to configure this cross-account log aggregation topology? (Select TWO.)

  1. In the Security account, create a CloudWatch Logs destination that points to the Kinesis Data Firehose delivery stream and references an IAM role that allows CloudWatch Logs to write to the stream. Configure a destination policy on the CloudWatch Logs destination that grants the member accounts permission to perform the logs:PutSubscriptionFilter action.Answer
  2. In each member account, create a CloudWatch Logs subscription filter on the target application log groups, specifying the Amazon Resource Name (ARN) of the CloudWatch Logs destination in the Security account as the target.Answer
  3. C
    In the Security account, configure the S3 bucket policy of the destination bucket to grant logs.amazonaws.com and the member account IDs direct s3:PutObject permissions, and configure the source accounts to write to the S3 bucket directly.
  4. D
    In the Security account, encrypt the Kinesis Data Firehose delivery stream using the AWS-managed KMS key (aws/kinesis) and modify its key policy to allow the member account IAM roles to perform kms:GenerateDataKey and kms:Decrypt actions.
  5. E
    Attach a Service Control Policy (SCP) at the root of the AWS Organization that grants member accounts the logs:PutSubscriptionFilter permission to automatically push all CloudWatch log groups to the central destination without local configuration.

Answer

The correct configurations involve creating a CloudWatch Logs destination in the Security account that points to the Kinesis Data Firehose delivery stream, configuring a destination policy allowing the source accounts to execute logs:PutSubscriptionFilter, and creating a subscription filter on the target log groups in the member accounts referencing the Security account's destination ARN.
Setting up a CloudWatch Logs destination in the Security account with a resource policy allowing logs:PutSubscriptionFilter, along with configuring local subscription filters in the source accounts targeting the destination's ARN, correctly implements the cross-account subscription filter architecture. The destination is associated with an IAM service role that authorizes CloudWatch Logs to write to Kinesis Data Firehose.

Step-by-Step Solution

1
Set up the target ingestion stream in the centralized Logging/Security account.
Create an Amazon Kinesis Data Firehose delivery stream configured to write to the destination S3 bucket.
This provides the ingestion pipeline for incoming streaming log data from all organization accounts.
2
Establish cross-account trust and log destination properties in the Security account.
Create a CloudWatch Logs destination referencing the Kinesis Data Firehose stream and an IAM role with a trust policy for logs.amazonaws.com. Attach a destination policy using PutDestinationPolicy to allow source accounts logs:PutSubscriptionFilter access.
This creates the endpoint that source accounts can target and authorizes cross-account access securely.
3
Configure log groups in the source member accounts to forward events.
Create a CloudWatch Logs subscription filter in each member account's target log groups pointing to the central destination ARN.
This establishes the active forwarding mechanism to stream local CloudWatch log events to the central destination.

Key Concept

Cross-account log aggregation with CloudWatch Logs requires establishing a CloudWatch Logs Destination in the receiving account, securing it via a resource-based destination policy, and creating local subscription filters targeting that destination in the sending accounts.
Rate this question

Topics

Centralized Monitoring, Logging, and Auditing Solutions

More questions from this topic