Examkin

Question

Difficulty: MediumImproving Operational Excellence via Monitoring and Logging

An enterprise operates a critical e-commerce platform on Amazon EC2 instances managed by an Auto Scaling group in a production AWS account. The application writes transaction and system logs to `/var/log/app/service.log`. These logs undergo hourly rotation, where the active log file is renamed to `/var/log/app/service.log.YYYY-MM-DD-HH` and a new empty log file is created. The company wants to implement a near real-time monitoring and centralization solution. They need to monitor these logs in CloudWatch Logs for real-time error rate alerting and also store the logs in a centralized Amazon S3 bucket located in a separate security AWS account for long-term audit compliance. Which two configurations should a solutions architect implement to meet these requirements?

  1. Install the CloudWatch agent on the EC2 instances. Configure the agent configuration file with the `file_path` parameter set to `/var/log/app/service.log*` to ensure that both the active log file and any rotated files are continuously monitored and sent to CloudWatch Logs.Answer
  2. B
    Install the CloudWatch agent on the EC2 instances. Configure the agent configuration file with the `file_path` parameter set to the static path `/var/log/app/service.log` to track the active log file, relying on the agent to automatically follow the file descriptor across hourly rotations.
  3. In the security account, configure the S3 bucket policy to grant `s3:PutObject` and `s3:PutObjectAcl` permissions to the specific IAM role ARN used by the Kinesis Data Firehose delivery stream in the production account. In the production account, configure a CloudWatch Logs subscription filter to stream the log group to Kinesis Data Firehose, which delivers them to the security account's S3 bucket.Answer
  4. D
    In the security account, configure the S3 bucket policy to grant `s3:PutObject` permissions to the `logs.amazonaws.com` service principal, and configure a CloudWatch Logs subscription filter in the production account to stream logs directly to the security account's S3 bucket.
  5. E
    In the production account, configure the CloudWatch agent to write logs directly to the security account's S3 bucket by configuring the `s3_delivery` block in the agent's configuration file, and attach a Service Control Policy (SCP) to the production account that grants `s3:PutObject` access to the security account's S3 bucket.

Answer

Install the CloudWatch agent on the EC2 instances with a wildcard file path (`/var/log/app/service.log*`) to handle log rotation, and configure a CloudWatch Logs subscription filter in the production account to stream logs to a Kinesis Data Firehose delivery stream, which writes to the security account's S3 bucket using an S3 bucket policy that permits the Firehose IAM role.
The correct solution involves configuring the CloudWatch agent to monitor application logs using a wildcard path to ensure rotated log files are not missed, and then streaming those logs cross-account to the security account's S3 bucket using a CloudWatch Logs subscription filter pointing to Kinesis Data Firehose, with a bucket policy that explicitly permits the Firehose IAM role to write to the bucket.

Step-by-Step Solution

1
Configure the CloudWatch agent on the EC2 instances to track rotated logs using wildcards.
By using the wildcard pattern `/var/log/app/service.log*`, the CloudWatch agent successfully monitors the active log file and any recently rotated log files without losing data during hourly rotations.
Static paths do not track renamed files after rotation, resulting in log loss.
2
Set up a CloudWatch Logs subscription filter in the production account to forward logs to Kinesis Data Firehose.
Real-time logs are streamed continuously from the CloudWatch Logs log group to the Kinesis Data Firehose delivery stream.
CloudWatch Logs subscription filters cannot write directly to S3 and require an intermediate streaming service like Kinesis Data Firehose.
3
Configure the cross-account S3 bucket policy in the security account to trust the Firehose IAM role.
The Kinesis Data Firehose stream in the production account is authorized to write logs into the security account's S3 bucket.
Cross-account S3 access must be explicitly allowed by the bucket policy for the writer's IAM role, as default ACLs are insufficient and disabled by default.

Key Concept

Continuous application log monitoring using the CloudWatch agent with log rotation handling, combined with real-time cross-account log centralization to S3 via CloudWatch subscription filters and Kinesis Data Firehose.
Rate this question

Topics

Improving Operational Excellence via Monitoring and Logging