Examkin

Question

Difficulty: Very hardImproving Operational Excellence via Monitoring and Logging

An enterprise operates a microservices-based application running on Amazon EC2 instances across multiple member accounts in an AWS Organization. The application logs are stored locally on the instances in `/var/log/app/application.log` and undergo hourly rotation, renaming the files with a timestamp suffix (for example, `/var/log/app/application.log.2026-07-16-11`). A Solutions Architect must design a centralized logging solution to stream these logs in near real-time to an Amazon S3 bucket in a central security account. The solution must ensure that log collection is continuous and unaffected by file rotation, and it must follow the principle of least privilege, avoiding cross-account IAM role assumptions from EC2 instances where resource-based policies can be used instead. Which two actions should the Solutions Architect take to implement this solution?

  1. Configure the CloudWatch agent on the EC2 instances using a wildcard path configuration, such as `/var/log/app/application.log*`, to monitor the log directory, and stream the logs to a local log group in each member account's Amazon CloudWatch Logs.Answer
  2. In the central security account, update the S3 bucket policy to allow `s3:PutObject` and `s3:PutObjectAcl` permissions, specifying the Kinesis Data Firehose delivery stream IAM roles from each member account as the principals. In each member account, create a Kinesis Data Firehose delivery stream targeting the central S3 bucket, and set up a CloudWatch Logs subscription filter to forward the logs to the local delivery stream.Answer
  3. C
    Configure the CloudWatch agent on the EC2 instances with a static file path configuration pointing directly to `/var/log/app/application.log`, relying on the agent's default file-tracking behavior to automatically track rotated log descriptors.
  4. D
    Configure the CloudWatch agent on the EC2 instances to stream logs directly to an Amazon Kinesis Data Firehose delivery stream in the central account. Update the destination S3 bucket policy to grant write access using a wildcard principal with a condition limiting access to the AWS Organization ID using the `aws:PrincipalOrgID` key.
  5. E
    Create a cross-account IAM role in the central security account that has permissions to write to CloudWatch Logs. Configure the CloudWatch agent on the EC2 instances in each member account to assume this cross-account role and write the log streams directly to a centralized log group.

Answer

Configure the CloudWatch agent on the EC2 instances using a wildcard path configuration to monitor and stream logs to a local log group in each member account, and update the central S3 bucket policy to allow s3:PutObject and s3:PutObjectAcl permissions to Kinesis Data Firehose delivery stream roles in each member account.
The Solutions Architect must configure the CloudWatch agent with a wildcard path pattern to ensure that the agent continues to monitor both the active log file and any rotated logs containing timestamps in their names. To centralize the logs with least privilege, logs should be published locally to CloudWatch Logs in each member account first. Then, subscription filters can stream the logs to Kinesis Data Firehose. Since Kinesis Data Firehose does not support writing across accounts natively without permissions on both ends, the destination S3 bucket policy in the central account must explicitly grant write permissions to the IAM role of each member account's Firehose stream. This prevents the EC2 instances from needing to assume cross-account roles.

Step-by-Step Solution

1
Configure the CloudWatch agent log path.
The agent configuration uses a wildcard suffix to monitor files.
This ensures the agent tracks new log entries even after files are rotated and renamed with a timestamp suffix.
2
Create local CloudWatch Log groups and stream logs.
Logs are sent to local CloudWatch Log groups in each member account.
This decouples local collection from cross-account transmission and allows local processing or retention.
3
Configure cross-account log streaming using Kinesis Data Firehose.
Logs are forwarded from local log groups via subscription filters to Kinesis Data Firehose, which writes to the central S3 bucket.
This provides a highly scalable, near real-time streaming pipeline without requiring EC2 instances to assume cross-account IAM roles directly.
4
Configure the S3 bucket policy in the central account.
The S3 bucket policy grants write access to the IAM roles of the Firehose delivery streams in each member account.
This satisfies least-privilege security requirements and allows cross-account delivery without open access or complex role switching on the client side.

Key Concept

Continuous, robust log ingestion during rotation and cross-account centralization using resource-based policies.
Estimated Time:3m 0s
Rate this question

Topics

Improving Operational Excellence via Monitoring and Logging