Examkin

Question

Difficulty: MediumImproving Operational Excellence via Monitoring and Logging

A smart agriculture enterprise operates a telemetry data processing application on Amazon EC2 instances in an Auto Scaling group. The application writes system and sensor processing logs to `/var/log/telemetry/gateway.log`. The application rotates logs hourly, renaming the historical logs to `/var/log/telemetry/gateway.log.YYYY-MM-DD-HH`. The company's operations team has installed the CloudWatch agent on the instances, but notices that logs generated after the hourly rotation are not being sent to Amazon CloudWatch Logs.

Additionally, the enterprise wants to centralize AWS CloudTrail logs from all member accounts in their AWS Organization into a single Amazon S3 bucket located in a dedicated Security account.

Which of the following actions should the Solutions Architect take to resolve these logging issues? (Select TWO.)

  1. Update the CloudWatch agent configuration file on the EC2 instances, setting the `file_path` parameter to `/var/log/telemetry/gateway.log*` to capture both the active log file and the rotated log files.Answer
  2. B
    Update the CloudWatch agent configuration file on the EC2 instances, setting the `file_path` parameter to the static path `/var/log/telemetry/gateway.log` and enabling the `track_file_descriptor` setting to follow log rotation.
  3. Configure the S3 bucket policy in the Security account to grant `s3:PutObject` permissions to the CloudTrail service principal (`cloudtrail.amazonaws.com`), using the `aws:PrincipalOrgID` condition key to restrict write access to the organization.Answer
  4. D
    Configure the S3 bucket policy in the Security account to grant `s3:PutObject` permissions to the root IAM ARNs of all member accounts, relying on Service Control Policies (SCPs) to enforce log delivery only via CloudTrail.
  5. E
    Configure the CloudWatch agent configuration file on the EC2 instances, setting the `file_path` parameter to the directory `/var/log/telemetry/` and enabling the `auto_rotation_discovery` parameter to track rotated log files.

Answer

The correct solutions are to update the CloudWatch agent configuration file on the EC2 instances to use the wildcard path `/var/log/telemetry/gateway.log*` to match both active and rotated files, and to configure the S3 bucket policy in the Security account to grant `s3:PutObject` permissions to the CloudTrail service principal (`cloudtrail.amazonaws.com`) restricted by the `aws:PrincipalOrgID` condition key.
The Solutions Architect must configure the CloudWatch agent with a wildcard pattern (`/var/log/telemetry/gateway.log*`) to ensure the agent monitors both the active log file and any newly renamed files after rotation. In addition, the central S3 bucket policy must allow `s3:PutObject` actions for the CloudTrail service principal (`cloudtrail.amazonaws.com`) and restrict it to the organization's accounts using the `aws:PrincipalOrgID` condition.

Step-by-Step Solution

1
Use a wildcard pattern in the CloudWatch agent configuration.
The agent can track and tail both `/var/log/telemetry/gateway.log` and the hourly renamed log files.
A static path configuration causes the agent to lose track of the log file after rotation, whereas wildcards allow the agent to continuously monitor rotated files.
2
Configure the destination S3 bucket policy to trust the CloudTrail service principal.
CloudTrail can deliver logs from all accounts within the organization to the central bucket.
CloudTrail uses its own service principal (`cloudtrail.amazonaws.com`) to write logs to S3, and the `aws:PrincipalOrgID` condition key ensures only logs from accounts belonging to the organization are allowed.

Key Concept

Improving operational excellence by properly configuring log collection paths for rotated logs in the CloudWatch Agent, and configuring S3 bucket policies to allow secure cross-account log delivery for AWS CloudTrail.
Rate this question

Topics

Improving Operational Excellence via Monitoring and Logging