Examkin

Question

Difficulty: MediumVPC Security Controls and Traffic Analysis

A SysOps Administrator is setting up VPC Flow Logs to capture traffic from a critical production subnet and deliver the log events to an Amazon CloudWatch Logs log group. When trying to create the VPC Flow Log using an existing IAM role, the AWS Management Console displays an Access Denied error, despite the IAM role having a trust policy that allows the vpc-flow-logs.amazonaws.com service to assume it. Additionally, the administrator must ensure that these security logs do not incur indefinite storage costs.

Which of the following actions should the administrator take to resolve the creation error and manage the storage costs? (Select TWO.)

  1. Attach an IAM policy to the administrator's user or group that grants the iam:PassRole permission for the VPC Flow Logs IAM role.Answer
  2. Configure the retention setting on the destination CloudWatch Logs log group to automatically expire logs after a defined duration.Answer
  3. C
    Add the iam:PassRole action to the trust policy of the IAM role so that CloudWatch Logs can publish logs to the log group.
  4. D
    Set a custom log retention period in the VPC Flow Log configuration settings during creation.
  5. E
    Update the subnet's outbound Network ACL rules to allow traffic to the CloudWatch Logs endpoint on ephemeral ports.

Answer

Attach an IAM policy to the administrator's user or group that grants the iam:PassRole permission for the VPC Flow Logs IAM role, and configure the retention setting on the destination CloudWatch Logs log group to automatically expire logs after a defined duration.
The correct options are to grant the iam:PassRole permission to the administrator's user policy, and to configure a retention period directly on the destination CloudWatch Logs log group. The iam:PassRole permission is required for the user/operator to associate an IAM role with the flow log configuration. Configuring retention on the destination CloudWatch Logs log group ensures that log events are automatically deleted after a specified period, optimizing cost.

Step-by-Step Solution

1
Address the Access Denied issue by modifying the SysOps Administrator's IAM permissions.
Adding the iam:PassRole action to the administrator's IAM policy for the flow logs role allows the console to pass the role to the VPC Flow Logs service.
Creating a VPC Flow Log requires the creator to have permission to pass the IAM role that the service will assume.
2
Configure the retention settings on the CloudWatch Logs log group.
The log group is configured with a specific retention period (e.g., 90 days) instead of the default Never Expire setting.
This automatically purges older log data and controls long-term storage costs.

Key Concept

Configuring permissions and lifecycle options for VPC Flow Logs requires both identity-based permissions (iam:PassRole) to delegate the service role and log group retention policies in CloudWatch to optimize storage costs, as delivery itself occurs out-of-band.
Rate this question

Topics

VPC Security Controls and Traffic Analysis

More questions from this topic