Examkin

Question

Difficulty: MediumImproving Operational Excellence via Monitoring and Logging

A company is hosting a hybrid application on a fleet of self-managed Linux EC2 instances. The application writes its runtime logs to `/var/log/app/application.log`. These logs are rotated hourly using a log utility that renames the active file to `application.log.YYYY-MM-DD-HH` and creates a new empty `application.log` file. The solutions architect needs to centralize these application logs into an Amazon CloudWatch Logs group in a central Security account. Additionally, the solutions architect must configure a multi-account AWS CloudTrail trail to deliver management events from all AWS accounts in the AWS Organization to a centralized Amazon S3 bucket in the same Security account. Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

  1. Configure the CloudWatch agent on the EC2 instances using a wildcard path, such as `/var/log/app/application.log*`, in the `file_path` parameter of the agent configuration file to ensure all rotated log files are tracked and ingested.Answer
  2. Configure the S3 bucket policy in the Security account to grant the `cloudtrail.amazonaws.com` service principal `s3:PutObject` permissions, and use the `aws:PrincipalOrgID` condition key to allow log delivery from the organization's member accounts.Answer
  3. C
    Configure the CloudWatch agent on the EC2 instances with the static file path `/var/log/app/application.log` in the `file_path` parameter, relying on the agent's file descriptor tracking to automatically monitor rotated log files.
  4. D
    Configure the S3 bucket policy in the Security account to grant `s3:PutObject` permissions to the IAM roles of all member accounts in the organization, enabling the local CloudTrail service in each account to write logs directly to the bucket.
  5. E
    Attach a Service Control Policy (SCP) to the organization's root that grants the CloudTrail service principal in all member accounts permission to perform `s3:PutObject` on the centralized S3 bucket in the Security account.

Answer

Configure the CloudWatch agent on the EC2 instances using a wildcard path, such as `/var/log/app/application.log*`, in the `file_path` parameter of the agent configuration file, and configure the S3 bucket policy in the Security account to grant the `cloudtrail.amazonaws.com` service principal `s3:PutObject` permissions while using the `aws:PrincipalOrgID` condition key to allow log delivery from the organization's member accounts.
The correct options involve configuring the CloudWatch agent to use a wildcard path (such as `/var/log/app/application.log*`) to monitor all rotated files and avoid data loss, and configuring the centralized S3 bucket policy to allow the `cloudtrail.amazonaws.com` service principal to write objects while restricting access to the organization using the `aws:PrincipalOrgID` condition.

Step-by-Step Solution

1
Configure the CloudWatch agent configuration file with a wildcard path pattern.
The agent matches rotated log files (e.g., `application.log.2026-07-16-11`) and successfully ingests remaining log entries before they are locked or deleted.
Log rotation renames the active file, and a static path config would lose track of the renamed files.
2
Create an S3 bucket in the Security account and attach a bucket policy allowing `cloudtrail.amazonaws.com` to perform `s3:PutObject`.
The central S3 bucket accepts log writes from the CloudTrail service principal.
CloudTrail is a service principal that writes logs directly, requiring resource-based permissions on the target S3 bucket.
3
Add an `aws:PrincipalOrgID` condition to the S3 bucket policy.
Only CloudTrail services originating from accounts within the specific AWS Organization can write to the bucket.
This secures the bucket and enables all organization member accounts to centralize logs without listing individual account IDs.

Key Concept

Improving operational excellence involves configuring agents properly to handle log rotation and ensuring secure centralized logging architectures via resource-based policies and organizational conditions.
Rate this question

Topics

Improving Operational Excellence via Monitoring and Logging