Examkin

Question

Difficulty: MediumImproving Operational Excellence via Monitoring and Logging

An enterprise runs a critical microservices application deployed on Amazon EC2 instances in an Auto Scaling group across multiple member accounts in an AWS Organizations organization. The application is configured to write logs directly to dynamically named, hourly files based on a timestamp pattern (for example, `/var/log/microservice/api-2026-07-16-11.log`). The company wants to implement continuous, real-time log collection using the unified Amazon CloudWatch agent installed on the instances. The log streams are then forwarded from CloudWatch Logs via subscription filters to Amazon Kinesis Data Firehose in each member account, which must deliver the logs to a centralized Amazon S3 bucket in a dedicated logging account. A Solutions Architect observes two issues: 1. Log delivery stops after the first hour of instance execution, and logs in the newly generated files are not sent to CloudWatch Logs. 2. Even when logs are written to CloudWatch Logs, Kinesis Data Firehose is unable to deliver them to the centralized S3 bucket, resulting in delivery failures. Which combination of actions will resolve the logging issues and ensure continuous, centralized log delivery?

  1. A
    Configure the CloudWatch agent's `file_path` as `/var/log/microservice/api.log` with the `log_rotation` option set to true. Update the S3 bucket policy in the centralized logging account to allow `s3:PutObject` actions, but omit the principal block to let any AWS Organizations member account write to it automatically.
  2. Configure the CloudWatch agent's `file_path` as `/var/log/microservice/api-*.log` to match the dynamically generated log files. Update the centralized S3 bucket policy to grant `s3:PutObject` permissions to the Kinesis Data Firehose IAM roles in the member accounts, using the `aws:PrincipalOrgID` condition to restrict access to the organization.Answer
  3. C
    Configure the CloudWatch agent's `file_path` as `/var/log/microservice/api.log` to monitor the logs. Update the centralized S3 bucket policy to allow the member accounts' Kinesis Data Firehose IAM roles to write to the bucket, and configure the bucket to use the default AWS-managed KMS key (`aws/s3`) for encryption.
  4. D
    Configure the CloudWatch agent's `file_path` as `/var/log/microservice/api-*.log` to capture the log files. Attach an IAM policy with `s3:PutObject` permissions directly to the member accounts' Kinesis Data Firehose IAM roles, without modifying the centralized S3 bucket policy, relying on role delegation instead.

Answer

Configure the CloudWatch agent to use the wildcard path to match dynamically named hourly files, and update the centralized S3 bucket policy to grant write permissions to the cross-account Firehose roles restricted by the organization ID.
The correct configuration uses a wildcard pattern to capture dynamically generated log files on the instances and applies a resource-based policy to the centralized S3 bucket to allow Kinesis Data Firehose in member accounts to upload logs, restricted to the organization ID.

Step-by-Step Solution

1
Change the `file_path` in the CloudWatch agent configuration from a static path to a wildcard pattern matching the hourly timestamp suffix.
The CloudWatch agent successfully monitors and collects logs from dynamically created hourly log files.
Because the application creates new files with timestamp suffixes hourly, a static path would only collect logs from the initial file and miss all subsequent logs.
2
Modify the centralized S3 bucket policy in the logging account to permit `s3:PutObject` operations from the Kinesis Data Firehose execution roles of the member accounts.
Kinesis Data Firehose is authorized to write log objects into the centralized S3 bucket.
Cross-account access to S3 resources requires the bucket owner to explicitly grant access in the bucket policy; user policies in the source account are not sufficient by themselves.
3
Add an `aws:PrincipalOrgID` condition to the centralized S3 bucket policy's statement.
Log writes are restricted to only member accounts within the AWS Organization, enforcing security best practices.
This ensures that only authorized accounts belonging to the organization can deliver logs to the centralized bucket.

Key Concept

Configuring unified CloudWatch agent wildcards for dynamic application log files and establishing cross-account S3 bucket policies for Kinesis Data Firehose centralization.
Rate this question

Topics

Improving Operational Excellence via Monitoring and Logging