An enterprise operates a high-transaction e-commerce application deployed on Amazon EC2 instances in an Auto Scaling group. The application writes operational logs to `/var/log/ecommerce/transactions.log`. These logs are rotated hourly and renamed with a timestamp suffix, such as `/var/log/ecommerce/transactions.log.2026-07-16-11`. The Solutions Architect needs to implement a solution to collect these logs, ensure no data loss during rotation, and centralize them in an Amazon S3 bucket in a dedicated logging account within the AWS Organization. Which combination of actions should the Solutions Architect take to meet these requirements? (Select TWO.)
- Configure the CloudWatch agent on the EC2 instances using a configuration file that specifies the log file path as `/var/log/ecommerce/transactions.log*` to monitor both the active and rotated files.Answer
- BConfigure the CloudWatch agent on the EC2 instances using a configuration file that specifies the log file path statically as `/var/log/ecommerce/transactions.log` and schedule a cron job to restart the agent service hourly after rotation.
- Create an Amazon Kinesis Data Firehose delivery stream in the application account to write logs to the centralized Amazon S3 bucket, and configure the destination S3 bucket policy in the logging account to grant `s3:PutObject` permissions to the Firehose IAM role ARN.Answer
- DConfigure the CloudWatch agent to write logs directly to the centralized Amazon S3 bucket in the logging account, and update the destination S3 bucket policy to allow the `cloudwatch.amazonaws.com` service principal to write objects.
- ESet up a cross-account IAM role in the application account that the logging account can assume to pull logs directly from the EC2 instance ephemeral storage using AWS Systems Manager Run Command.
Answer
The correct configuration involves using a wildcard pattern (`/var/log/ecommerce/transactions.log*`) in the CloudWatch agent configuration to track rotated files, and creating a Kinesis Data Firehose delivery stream in the application account with a destination S3 bucket policy in the logging account that grants write permissions to the Firehose IAM role ARN.
The correct solution involves configuring the CloudWatch agent with a wildcard path (`/var/log/ecommerce/transactions.log*`) to ensure the agent monitors both the active file and any rotated log files containing timestamp suffixes. Additionally, setting up a Kinesis Data Firehose delivery stream in the source account that writes to the centralized S3 bucket in the logging account, while granting `s3:PutObject` permissions to the Firehose IAM role ARN in the destination bucket policy, ensures secure cross-account delivery.
Step-by-Step Solution
Key Concept
Continuous log ingestion with rotation handling and secure cross-account log centralization.