An enterprise operates a multi-account AWS environment managed under AWS Organizations. In the production account, a critical payment processing application runs on a fleet of Amazon EC2 instances. The application writes its logs to a local directory at /var/log/payment/app.log. To manage local disk space, the application's logging framework rotates the logs hourly by renaming the active file to app-YYYY-MM-DD-HH.log (e.g., app-2026-07-16-10.log) and creating a new empty app.log file. The CloudWatch unified agent is deployed on the EC2 instances, configured to stream /var/log/payment/app.log to a centralized CloudWatch Logs account. The security operations team reports that after the hourly rotation, the centralized log group stops receiving new log entries, and streaming only resumes after manually restarting the CloudWatch agent service on each instance. Which of the following configuration modifications is the most operationally efficient way to resolve this issue and ensure continuous log streaming?
- AMaintain the static file_path parameter as /var/log/payment/app.log and schedule a cron job on the EC2 instances to restart the CloudWatch agent service every hour immediately following the log rotation.
- Update the CloudWatch agent configuration file on the EC2 instances by changing the file_path parameter to /var/log/payment/app-*.log to enable the agent to dynamically track and stream newly created log files matching the wildcard pattern.Answer
- CConfigure an Amazon Kinesis Data Firehose delivery stream to write the logs directly to a centralized Amazon S3 bucket, and apply an S3 bucket policy in the destination account that grants write permissions using only the aws:SourceOrgID condition key without specifying the Kinesis Firehose service principal.
- DEnable KMS encryption on the target CloudWatch log group in the central logging account using the default AWS-managed KMS key (aws/logs) and modify the key policy to delegate cross-account write permissions to the production account.