Examkin

Question

Difficulty: EasyVPC Flow Logs and Network Monitoring

A SysOps Administrator is setting up VPC Flow Logs to publish network traffic metadata to an Amazon CloudWatch Logs group. After configuring the flow log, the administrator notices that no log streams are being created in the target CloudWatch log group. What is the most likely cause of this issue?

  1. A
    The SysOps Administrator's IAM user policy is missing the iam:PassRole action, which is required in the trust policy of the role being assumed by the VPC Flow Logs service.
  2. The IAM role associated with the flow log does not have a trust relationship allowing the vpc-flow-logs.amazonaws.com service principal to assume it.Answer
  3. C
    The target CloudWatch Logs group is configured with an active 1-day log retention policy, which blocks new flow logs from being initially written.
  4. D
    The route table for the subnets being monitored is missing a route to an Internet Gateway, which prevents the flow logs from being sent to the CloudWatch service endpoint.

Answer

The IAM role associated with the flow log does not have a trust relationship allowing the vpc-flow-logs.amazonaws.com service principal to assume it.
For VPC Flow Logs to successfully publish to CloudWatch Logs, the service must assume an IAM role. The role must contain a trust policy (trust relationship) that allows the service principal 'vpc-flow-logs.amazonaws.com' to perform the 'sts:AssumeRole' action. Without this trust relationship, delivery fails silently and no log streams are created in the target log group.

Step-by-Step Solution

1
Verify that VPC Flow Logs are configured to publish to CloudWatch Logs.
Confirming the configuration target shows that logs are destined for CloudWatch Logs.
This establishes the scope of delivery permissions required.
2
Examine the IAM role's trust policy associated with the VPC Flow Log configuration.
Ensure that the trust policy grants 'sts:AssumeRole' permissions to the 'vpc-flow-logs.amazonaws.com' service principal.
The VPC Flow Logs service must be trusted to assume the delivery role in order to create log streams and put log events.
3
Ensure that the IAM role's permission policy allows creating log groups, log streams, and putting log events to CloudWatch.
The role will have full operational access to log delivery.
Both trust relationship and functional IAM permissions are required for successful flow log generation.

Key Concept

VPC Flow Logs require an IAM role with a trust policy that allows the vpc-flow-logs.amazonaws.com service principal to assume the role, plus permission to publish logs to Amazon CloudWatch Logs.
Rate this question

Topics

VPC Flow Logs and Network Monitoring

More questions from this topic