Examkin

Question

Difficulty: MediumVPC Security Controls and Traffic Analysis

A SysOps administrator is configuring a VPC Flow Log to publish traffic metadata from a custom VPC to an Amazon CloudWatch Logs log group. The administrator has already created the target log group and an IAM role named VPCFlowLogRole that trusts the vpc-flow-logs.amazonaws.com service principal. The IAM role has a policy that allows it to create log streams and publish log events. When the administrator attempts to create the flow log, the operation fails with an authorization error. Additionally, company security policy requires that flow log data must not be stored indefinitely. Which combination of actions will resolve the creation error and meet the security requirements? (Select TWO.)

  1. Add iam:PassRole permissions to the IAM policy of the SysOps administrator, targeting the Amazon Resource Name (ARN) of the VPCFlowLogRole.Answer
  2. Configure a retention period on the CloudWatch Logs log group to automatically expire log events after the desired timeframe.Answer
  3. C
    Add iam:PassRole permissions to the trust policy of the VPCFlowLogRole to trust the administrator's IAM user.
  4. D
    Attach an IAM policy to the SysOps administrator allowing the sts:AssumeRole action on the VPCFlowLogRole.
  5. E
    Configure a log retention policy within the VPC Flow Log configuration settings to delete logs after the specified period.

Answer

To resolve the authorization issue and comply with the log retention policy, the SysOps administrator must have the iam:PassRole permission for the VPCFlowLogRole in their IAM policy, and a log retention period must be configured on the CloudWatch Logs log group destination.
The correct combination requires granting the SysOps administrator the iam:PassRole permission to pass the VPCFlowLogRole to the VPC Flow Logs service, which resolves the creation-time authorization error. Additionally, configuring the log retention period on the CloudWatch Logs log group ensures that log events are automatically deleted after the specified time and not stored indefinitely.

Step-by-Step Solution

1
Analyze the cause of the authorization failure during VPC Flow Log creation.
The VPC Flow Logs service requires a service role (VPCFlowLogRole) to write logs to CloudWatch. When an administrator creates the flow log and associates it with this role, AWS checks if the administrator has permission to delegate (pass) that role. The missing permission is iam:PassRole on the administrator's policy.
Ensures the administrator has the administrative authority to assign the role to the AWS service.
2
Address the log retention security requirement.
Confirm that VPC Flow Logs configurations themselves do not support lifecycle or retention management. The logs are delivered to a CloudWatch Logs log group, which supports configurable retention periods (e.g., 30 days, 90 days, etc.) rather than the default 'Never Expire'.
Allows compliance with the organizational requirement to not store log data indefinitely while keeping configuration at the correct destination resource level.

Key Concept

VPC Flow Logs Permission Delegation and Destination Log Management
Rate this question

Topics

VPC Security Controls and Traffic Analysis

More questions from this topic