Examkin

Question

Difficulty: Very hardImproving Operational Excellence via Monitoring and Logging

An enterprise operates a high-volume microservices application running on a fleet of Amazon EC2 instances in an Auto Scaling group within a Production AWS account. The instances run the Unified CloudWatch Agent to collect application logs from `/var/log/app/output.log`. The logs undergo hourly rotation, where the active file is renamed to `/var/log/app/output.log.YYYY-MM-DD-HH` and a new empty `/var/log/app/output.log` is created.

To improve operational excellence, a Solutions Architect must centralize these logs into a CloudWatch log group in a dedicated Security account. The architecture must guarantee zero log loss during rotation, prevent duplicate ingestion of historical log lines, and secure the logs in transit and at rest using a customer-managed KMS key in the Security account.

Which of the following configurations meets these requirements with the least operational complexity?

  1. Configure the CloudWatch agent with the wildcard path `/var/log/app/output.log*` and specify a cross-account IAM role ARN in the agent's credentials configuration. Grant the cross-account role permissions to write to the central log group and access the customer-managed KMS key in the Security account.Answer
  2. B
    Configure the CloudWatch agent with the static path `/var/log/app/output.log` under the assumption that the agent automatically tracks the file descriptor during rotation, and specify a cross-account IAM role ARN in the agent's credentials configuration.
  3. C
    Configure the CloudWatch agent with the wildcard path `/var/log/app/output.log*` to send logs to a local log group. Establish a cross-account CloudWatch Logs subscription filter to stream logs directly to an S3 bucket in the Security account, using a bucket policy that grants access to the Production account's root IAM principal.
  4. D
    Configure the CloudWatch agent with the wildcard path `/var/log/app/output.log*` to send logs to a local log group. Create a cross-account CloudWatch subscription filter to write directly to the Security account's log group, encrypting the destination log group using the default AWS-managed KMS key `aws/logs` in the Security account.

Answer

Configure the CloudWatch agent with the wildcard path `/var/log/app/output.log*` and specify a cross-account IAM role ARN in the agent's credentials configuration. Grant the cross-account role permissions to write to the central log group and access the customer-managed KMS key in the Security account.
The correct configuration uses the wildcard path to ensure that both the active log file and any recently rotated hourly log files are scanned. By utilizing the credentials feature in the Unified CloudWatch Agent, the agent can assume the target IAM role in the Security account directly to execute `PutLogEvents`. A customer-managed KMS key is required because its key policy can be modified to grant the cross-account role permissions to decrypt and encrypt logs.

Step-by-Step Solution

1
Select the correct log path pattern in the CloudWatch agent config.
Using `/var/log/app/output.log*` allows the agent to monitor active and rotated logs simultaneously. The agent tracks state using file inodes to avoid duplicate ingestion.
Static paths like `/var/log/app/output.log` will fail to track logs written to the rotated file if there is any delay in delivery or if the agent restarts.
2
Configure cross-account log delivery in the Unified CloudWatch Agent.
The agent assumes the designated IAM role in the Security account using the credentials configuration.
This avoids having to route logs through a local log group and subscription filters, simplifying the architecture.
3
Ensure encryption compatibility for cross-account access.
Use a customer-managed KMS key in the Security account and update its key policy to allow the assumed cross-account IAM role to use the key.
AWS-managed KMS keys do not support policy modifications and cannot be used for cross-account delivery.

Key Concept

Unified CloudWatch Agent log path wildcarding and cross-account KMS key policy delegation.
Estimated Time:3m 0s
Rate this question

Topics

Improving Operational Excellence via Monitoring and Logging