Examkin

Question

Difficulty: HardImproving Operational Excellence via Monitoring and Logging

A global retail company runs its checkout application on Amazon EC2 instances in an Auto Scaling group across multiple member accounts in an organization in AWS Organizations. The application writes transaction logs to `/var/log/checkout/app.log`. The application server rotates logs hourly, renaming the active log file to `/var/log/checkout/app.log.1` (and shifting older logs to `app.log.2`, `app.log.3`, etc.) while creating a new `app.log` file.

The company wants to centralize these logs into an Amazon S3 bucket located in a dedicated Security account. The architecture must stream logs from the EC2 instances to CloudWatch Logs, and then forward them to the centralized S3 bucket via Amazon Kinesis Data Firehose. The solution must handle hourly log rotations without log loss and enforce least-privilege cross-account access.

Which two actions should a solutions architect take to meet these requirements? (Select TWO.)

  1. In the Unified CloudWatch Agent configuration file on the EC2 instances, configure the logs section with "file_path": "/var/log/checkout/app.log*" to monitor the log files.Answer
  2. B
    In the Unified CloudWatch Agent configuration file on the EC2 instances, configure the logs section with "file_path": "/var/log/checkout/app.log" and enable the "auto_reopen_on_rotate": true setting.
  3. Configure the S3 bucket policy in the Security account to grant s3:PutObject and s3:PutObjectAcl permissions to the IAM roles assumed by the Kinesis Data Firehose delivery streams in the member accounts, using the aws:PrincipalOrgID condition key to restrict access to the organization.Answer
  4. D
    Configure the S3 bucket policy in the Security account to allow s3:PutObject actions for the principal "*", and apply a Service Control Policy (SCP) at the organizational root level that allows the member accounts' Kinesis Data Firehose IAM roles to write to the Security account's S3 bucket.
  5. E
    In the Unified CloudWatch Agent configuration file on the EC2 instances, configure the logs section with "file_path": "/var/log/checkout/app.log" and configure a pre-rotation script on the EC2 instances that restarts the CloudWatch Agent service immediately after the log rotation occurs.

Answer

To achieve the monitoring and security goals, configure the Unified CloudWatch Agent on the EC2 instances with a wildcard path (`/var/log/checkout/app.log*`) to capture both active and rotated logs, and configure the central S3 bucket policy in the Security account to grant `s3:PutObject` and `s3:PutObjectAcl` permissions to the IAM roles of the member accounts' Kinesis Data Firehose delivery streams, scoped with the `aws:PrincipalOrgID` condition key.
The correct answer combines proper agent path configuration and cross-account permissions. Configuring the Unified CloudWatch Agent's `file_path` with a wildcard (`/var/log/checkout/app.log*`) ensures that renamed log files are tracked and read before the agent re-locks onto the newly created active log file, ensuring no data loss during rotation. In the central security account, the S3 bucket policy must permit the Kinesis Data Firehose IAM roles from member accounts to write to it (`s3:PutObject` and `s3:PutObjectAcl`). The policy must be secured by restricting access to the specific organization using the `aws:PrincipalOrgID` condition key, ensuring only trusted accounts within the AWS Organization can write to the central logging bucket.

Step-by-Step Solution

1
Configure log file path patterns in the CloudWatch Agent configuration.
Setting the `file_path` to `/var/log/checkout/app.log*` allows the agent to monitor both active and rotated log files, preventing data loss when logs are renamed.
Log files are renamed during hourly rotation. A static file path configuration misses logs written right before rotation that have not been read by the agent yet. Using a wildcard ensures the agent processes all rotated files.
2
Set up a cross-account S3 bucket policy in the Security account.
The bucket policy allows Kinesis Data Firehose IAM roles from member accounts to perform write operations.
S3 resources are private by default. For cross-account resources to write to the centralized bucket, the bucket owner must explicitly grant `s3:PutObject` and `s3:PutObjectAcl` permissions to the cross-account principals.
3
Enforce organization-wide security boundaries using AWS IAM condition keys.
Adding the `aws:PrincipalOrgID` condition key to the bucket policy ensures that only Firehose roles within the designated AWS Organization can write to the bucket.
This implements the principle of least privilege, preventing unauthorized external entities from writing to the centralized logging repository.

Key Concept

Handling rotated log files via Unified CloudWatch Agent wildcards and configuring cross-account S3 log delivery with AWS Organizations restriction keys.
Rate this question

Topics

Improving Operational Excellence via Monitoring and Logging