Examkin

Question

Difficulty: MediumSecurity Monitoring, Logging, and Compliance Auditing

A SysOps Administrator is configuring AWS CloudTrail to deliver log events to Amazon CloudWatch Logs for real-time compliance monitoring. The administrator needs to ensure that the integration is secure and log delivery is successful.

Which two configuration steps must the administrator perform to achieve this? (Select TWO.)

  1. Create an IAM role with a trust policy that allows the CloudTrail service principal to assume it, and attach a permissions policy allowing the logs:CreateLogStream and logs:PutLogEvents actions.Answer
  2. Specify a target CloudWatch Logs log group that resides in the same AWS Region as the CloudTrail trail.Answer
  3. C
    Enable detailed monitoring on the CloudTrail trail to decrease the delivery interval of events to CloudWatch Logs to one minute.
  4. D
    Configure an Amazon EventBridge rule to route CloudTrail API events directly to the CloudWatch Logs log group without requiring a service role.
  5. E
    Grant the iam:PassRole permission directly to the CloudTrail service principal within the IAM role's permissions policy.

Answer

The correct configurations are to create an IAM role with a trust policy that allows the CloudTrail service principal to assume it (with permissions for creating log streams and putting log events) and to specify a CloudWatch Logs log group in the same AWS Region as the CloudTrail trail.
The correct configuration requires establishing a cross-service trust and permission model. First, the CloudWatch Logs log group must exist in the same region as the CloudTrail trail. Second, an IAM role must be configured with a trust policy allowing the CloudTrail service principal to perform the assume role action, along with a permissions policy that grants the ability to create log streams and write log events into that specific log group.

Step-by-Step Solution

1
Set up the destination log group.
A CloudWatch Logs log group is created in the same AWS Region as the CloudTrail trail.
CloudTrail cannot send logs to a log group in a different region.
2
Configure the IAM role and policy.
An IAM role is created with a trust relationship allowing 'cloudtrail.amazonaws.com' to assume the role (sts:AssumeRole), and permissions are granted for logs:CreateLogStream and logs:PutLogEvents on the log group resource.
This allows CloudTrail to authenticate and securely write the log stream events to CloudWatch Logs.
3
Associate the role and log group with CloudTrail.
The CloudTrail trail is updated with the CloudWatch Logs log group ARN and the role ARN.
This completes the integration, allowing automated log forwarding to commence.

Key Concept

AWS CloudTrail integration with CloudWatch Logs requires a same-region destination log group and an IAM service role that trusts CloudTrail to write log streams.
Rate this question

Topics

Security Monitoring, Logging, and Compliance Auditing

More questions from this topic