Examkin

Question

Difficulty: MediumImproving Operational Excellence via Monitoring and Logging

An enterprise runs a critical application on a fleet of Amazon EC2 instances across multiple member accounts in an AWS Organization. The application writes operational logs to `/var/log/myapp/app-[timestamp].log`. Every hour, a cron job rotates these logs, compressing the older logs into `/var/log/myapp/app-[timestamp].log.gz` within the same directory. The company wants to implement a centralized logging architecture to stream these logs to a central Amazon S3 bucket in a dedicated monitoring account. The Solutions Architect must ensure that the CloudWatch agent on the EC2 instances collects all log entries continuously without ingesting duplicate data from the compressed files, and the logs are securely forwarded to the central S3 bucket with the least privilege, avoiding cross-account IAM role assumption from the EC2 instances. Which of the following actions should the Solutions Architect take to meet these requirements? (Select TWO.)

  1. In the CloudWatch agent configuration file on the EC2 instances, set the `file_path` parameter to `/var/log/myapp/app-*.log` under the logs collection section.Answer
  2. B
    In the CloudWatch agent configuration file on the EC2 instances, set the `file_path` parameter to `/var/log/myapp/app-*` under the logs collection section.
  3. In the monitoring account, create an Amazon Kinesis Data Firehose delivery stream and a CloudWatch Logs destination. Attach an IAM role to the destination allowing it to write to the Firehose stream, and apply a destination policy that permits `logs:PutSubscriptionFilter` for the AWS Organization. In the member accounts, create subscription filters that target the centralized Logs destination.Answer
  4. D
    In the monitoring account, configure the central Amazon S3 bucket policy to grant `s3:PutObject` access directly to the IAM roles attached to the EC2 instances in the member accounts, and configure the CloudWatch agent on the EC2 instances to stream logs directly to the S3 bucket.
  5. E
    In each member account, configure a CloudWatch Logs subscription filter to send logs directly to the central Amazon S3 bucket, and update the S3 bucket policy in the monitoring account to allow the `logs.amazonaws.com` service principal to perform `s3:PutObject` actions.

Answer

To implement the centralized logging architecture, the Solutions Architect should set the `file_path` parameter to `/var/log/myapp/app-*.log` in the CloudWatch agent configuration to prevent duplicate log ingestion of compressed archives, and set up a CloudWatch Logs destination and Kinesis Data Firehose stream in the central monitoring account, allowing member accounts to send logs using cross-account subscription filters.
Specifying the file path wildcard `/var/log/myapp/app-*.log` ensures that the CloudWatch agent only monitors active text log files and ignores the hourly rotated, compressed `.log.gz` files, preventing duplicate ingestion and binary processing. Additionally, creating a centralized CloudWatch Logs destination in the monitoring account linked to an Amazon Kinesis Data Firehose delivery stream allows member accounts to use native subscription filters to securely stream log events cross-account without needing cross-account IAM role assumptions from the EC2 instances.

Step-by-Step Solution

1
Configure the local CloudWatch agent log path with a wildcard pattern that explicitly targets only active log files.
The agent monitors files matching `/var/log/myapp/app-*.log` and ignores `/var/log/myapp/app-[timestamp].log.gz` files when they are rotated.
This prevents duplicate ingestion and corruption of logs caused by reading binary compressed files.
2
Set up a centralized ingestion pipeline in the monitoring account using a CloudWatch Logs destination linked to Kinesis Data Firehose.
A central endpoint is created that accepts log events cross-account and delivers them to the destination S3 bucket.
This establishes a secure, managed service integration that avoids EC2 instances needing direct cross-account write permissions.
3
Configure subscription filters in the member accounts targeting the centralized destination.
Logs are streamed automatically from member accounts to the central S3 bucket via the Kinesis Data Firehose pipeline.
This utilizes AWS native integration patterns to securely route log events across organizational accounts.

Key Concept

Improving Operational Excellence via Monitoring and Logging requires designing log collection agents to handle rotation events correctly and leveraging native cross-account streaming services like CloudWatch Logs destinations and Kinesis Data Firehose to centralize logs securely without cross-account IAM role assumptions.
Rate this question

Topics

Improving Operational Excellence via Monitoring and Logging