Examkin

Question

Difficulty: HardCloudWatch Dashboards and Container Insights

A SysOps Administrator needs to enable Amazon CloudWatch Container Insights on an existing Amazon EKS cluster that runs on Amazon EC2 worker nodes. The administrator needs to collect both container-level performance metrics and application logs, and view them on a unified dashboard. Which two actions should the SysOps Administrator take to configure this monitoring solution? (Select TWO.)

  1. Attach the CloudWatchAgentServerPolicy IAM managed policy to the IAM role of the Amazon EKS worker nodes.Answer
  2. Deploy the CloudWatch agent as a DaemonSet to collect performance metrics, and Fluent Bit as a DaemonSet to collect container logs.Answer
  3. C
    Enable detailed monitoring on the EC2 worker nodes using the Amazon EC2 console to enable container-level granular metric collection.
  4. D
    Configure an Amazon EventBridge rule that triggers an AWS Systems Manager Automation document to dynamically push logs from the EC2 worker nodes to CloudWatch.
  5. E
    Manually create the CloudWatch log groups for EKS and set their retention policy to Never Expire, as the CloudWatch agent and Fluent Bit cannot auto-create log groups.

Answer

Attach the CloudWatchAgentServerPolicy IAM managed policy to the IAM role of the Amazon EKS worker nodes, and deploy the CloudWatch agent as a DaemonSet to collect performance metrics, and Fluent Bit as a DaemonSet to collect container logs.
The correct options are attaching the CloudWatchAgentServerPolicy policy to the EKS worker nodes' IAM role, and deploying the CloudWatch agent and Fluent Bit DaemonSets. This ensures both permissions and agent workloads are properly configured on the EC2 instances supporting the cluster.

Step-by-Step Solution

1
Attach the CloudWatchAgentServerPolicy policy to the IAM role associated with the EKS worker nodes.
The EC2 worker nodes gain the necessary permissions to write metrics and logs to CloudWatch.
Security credentials must be granted to the node instances so that DaemonSets running on them can authenticate with CloudWatch endpoints.
2
Deploy the CloudWatch agent and Fluent Bit configuration maps and DaemonSets to the EKS cluster using kubectl.
The CloudWatch agent collects performance metrics from the container environments, and Fluent Bit collects stdout/stderr application logs from the containers' log paths.
DaemonSets run one pod copy per node, ensuring comprehensive collection of metrics and logs across all cluster resources.

Key Concept

Configuring Container Insights on EKS requires node permissions and DaemonSet configurations for the CloudWatch agent and Fluent Bit.
Rate this question

Topics

CloudWatch Dashboards and Container Insights

More questions from this topic