Examkin

Question

Difficulty: Very hardImproving Operational Excellence via Monitoring and Logging

An enterprise operates a payment processing platform deployed on Amazon EC2 instances in an Auto Scaling group across multiple member accounts in an AWS Organization. The application on each instance writes transaction and error logs to a local file path `/var/log/payment/app.log`. These logs are rotated hourly and renamed to `/var/log/payment/app.log.YYYY-MM-DD-HH` via a local cron job. The enterprise requires a centralized, secure logging solution to stream these logs to a single Amazon S3 bucket in a dedicated Security Account. The solution must ensure that no log entries are lost during log rotation, all log data is encrypted at rest using a customer managed key (CMK) in AWS KMS, and the architecture adheres to the principle of least privilege. Which two actions should the Solutions Architect take to satisfy these requirements? (Select TWO.)

  1. Configure the Unified CloudWatch Agent on the EC2 instances. In the agent configuration JSON file, specify `/var/log/payment/app.log*` in the `file_path` field under the `logs` section.Answer
  2. In the Security Account, create a cross-account CloudWatch Logs destination pointing to an Amazon Kinesis Data Firehose delivery stream that writes to the destination S3 bucket. In the member accounts, create CloudWatch Logs subscription filters that point to the Security Account's destination ARN.Answer
  3. C
    Configure the Unified CloudWatch Agent on the EC2 instances. In the agent configuration JSON file, specify `/var/log/payment/app.log` in the `file_path` field under the `logs` section, as the agent automatically detects log rotation and follows the renamed files via inode tracking.
  4. D
    In each member account, create an Amazon Kinesis Data Firehose delivery stream that writes directly to the central S3 bucket in the Security Account. Encrypt the S3 bucket using the default AWS-managed key (`aws/s3`) and configure the S3 bucket policy to allow the member accounts' Firehose IAM roles to perform `s3:PutObject`.
  5. E
    In the Security Account, create an Amazon S3 bucket and configure its bucket policy to allow `s3:PutObject` and `kms:GenerateDataKey` permissions for the root principal of the AWS Organization. Configure the CloudWatch agent on the EC2 instances to write log data directly to the S3 bucket using custom log destinations.

Answer

Configure the Unified CloudWatch Agent to monitor the wildcard log path `/var/log/payment/app.log*`, and set up a cross-account CloudWatch Logs destination in the Security Account targeting Kinesis Data Firehose, with subscription filters in the member accounts streaming to it.
To satisfy the logging and operational requirements, the CloudWatch Agent must be configured with the wildcard pattern `/var/log/payment/app.log*`. This ensures that during hourly rotation, the agent continues tracking the renamed file until all entries are ingested, avoiding log loss. Centralizing the logs is best achieved by establishing a cross-account CloudWatch Logs destination in the Security Account, backed by Kinesis Data Firehose which writes to the S3 bucket. This pattern delegates cross-account log ingestion via CloudWatch service-to-service communication, simplifying IAM policy management. Because Kinesis Data Firehose runs in the Security Account, it writes to the local S3 bucket, ensuring the Security Account owns the objects and can use a Customer Managed Key (CMK) for encryption.

Step-by-Step Solution

1
Analyze log rotation behavior and configure the CloudWatch Agent path pattern.
The agent must be configured with a wildcard pattern (`/var/log/payment/app.log*`) to ensure that logs rotated and renamed hourly are fully read and ingested even after the active log file is renamed.
If only the static path `/var/log/payment/app.log` is used, the agent will instantly switch to the new empty file on rotation, potentially leaving unread data in the renamed file.
2
Determine the cross-account logging delivery architecture.
Create a centralized CloudWatch Logs destination in the Security Account that points to a local Kinesis Data Firehose stream, and configure subscription filters in the member accounts' log groups to stream to this destination.
This setup allows secure, scalable cross-account streaming of CloudWatch Logs to a central account without managing complex cross-account S3 bucket writes or cross-account KMS key policies for Kinesis Data Firehose.
3
Validate security requirements (KMS key policy and bucket policy).
Create a Customer Managed Key (CMK) in the Security Account, configure its policy to allow the Security Account's Firehose IAM role to generate data keys and decrypt, and grant the Firehose role permission to write to the central S3 bucket.
AWS-managed KMS keys (such as `aws/s3`) do not support policy modification and cannot be shared across accounts, meaning they cannot be used if member accounts directly write to S3, but by utilizing Firehose in the Security Account, a Customer Managed Key can be easily scoped to the local Firehose role.

Key Concept

Centralizing cross-account logs securely using CloudWatch Logs destinations, Kinesis Data Firehose, and proper CloudWatch Agent wildcard paths for rotated logs.
Rate this question

Topics

Improving Operational Excellence via Monitoring and Logging