Examkin

Question

Difficulty: EasyImproving Operational Excellence via Monitoring and Logging

A company is improving the monitoring and auditing of its AWS environment. The company has a multi-account structure managed under AWS Organizations. An application running on Amazon EC2 instances in a member account writes logs to `/var/log/app/app.log`, which are rotated hourly. Additionally, the company needs to centralize CloudTrail logs from all member accounts into a single Amazon S3 bucket located in a central security account.

Which of the following actions should the Solutions Architect take to configure these logging requirements correctly? (Select TWO.)

  1. Configure the CloudWatch agent on the EC2 instances using a wildcard in the file_path pattern, such as `/var/log/app/app.log*`, to capture rotated log files.Answer
  2. Configure the S3 bucket policy in the security account to grant the `s3:PutObject` permission to the AWS CloudTrail service principal, specifying conditions for the AWS Organization ID.Answer
  3. C
    Configure the CloudWatch agent on the EC2 instances to monitor the static file path `/var/log/app/app.log`, as the agent automatically tracks file descriptor changes during log rotation.
  4. D
    Configure the S3 bucket policy in the security account to grant the `s3:PutObject` permission to the IAM roles of the individual member accounts, enabling them to write CloudTrail logs.
  5. E
    Attach a Service Control Policy (SCP) at the root level of the AWS Organization that grants the `s3:PutObject` permission on the central S3 bucket to all member accounts.

Answer

To capture rotated application logs, configure the CloudWatch agent with a wildcard pattern (e.g., `/var/log/app/app.log*`). To allow cross-account CloudTrail log delivery, configure the S3 bucket policy in the destination account to grant write permissions to the CloudTrail service principal (`cloudtrail.amazonaws.com`) and restrict access using the Organization ID condition.
To ensure continuous log collection after log rotation on Amazon EC2, the CloudWatch agent config must use wildcard patterns (e.g., `/var/log/app/app.log*`) so it matches newly rotated files. For centralizing CloudTrail logs across an organization to a single S3 bucket, the S3 bucket policy in the destination account must explicitly permit the CloudTrail service principal (`cloudtrail.amazonaws.com`) to write logs, restricted by the AWS Organization ID.

Step-by-Step Solution

1
Analyze the log rotation behavior on the EC2 instances.
Since the logs at `/var/log/app/app.log` are rotated hourly, they will be renamed. A static path configuration will fail to match rotated files.
Ensures that log collection is continuous across file rotations.
2
Select the correct CloudWatch agent file path pattern.
A wildcard pattern `/var/log/app/app.log*` is specified in the agent's configuration file.
Allows the agent to find and upload rotated logs.
3
Determine how CloudTrail delivers logs to S3.
CloudTrail uses the service principal `cloudtrail.amazonaws.com` rather than IAM roles from individual member accounts to write logs.
Required to design the correct IAM policy statements.
4
Configure the S3 bucket policy in the security account.
Grant `s3:PutObject` permissions to `cloudtrail.amazonaws.com` with a condition evaluating `aws:PrincipalOrgID`.
Secures the central logging bucket while allowing all organization accounts to deliver logs.

Key Concept

Continuous monitoring and log centralization require proper path wildcards for rotated files and appropriate resource-based policies for AWS service principals.
Rate this question

Topics

Improving Operational Excellence via Monitoring and Logging