Examkin

Question

Difficulty: MediumVPC Flow Logs and Network Monitoring

A SysOps Administrator is setting up VPC Flow Logs for a new application VPC to capture network traffic and deliver the logs to Amazon CloudWatch Logs. To comply with company guidelines, the administrator must ensure that the VPC Flow Logs service has permission to write to the CloudWatch Logs log group, and that any log data older than 90 days is automatically deleted to manage storage costs.

Which of the following actions should the SysOps Administrator perform to meet these requirements? (Select TWO.)

  1. Create an IAM role with a trust policy that allows the vpc-flow-logs.amazonaws.com service principal to assume the role, and attach a policy with logs:CreateLogStream and logs:PutLogEvents permissions.Answer
  2. Configure the retention setting on the target Amazon CloudWatch Logs log group to 90 days.Answer
  3. C
    Attach an IAM policy to the VPC Flow Logs service role that explicitly grants iam:PassRole permissions to the CloudWatch Logs log group.
  4. D
    Configure the log retention period of 90 days directly within the VPC Flow Logs configuration wizard during creation.
  5. E
    Create an Amazon EventBridge rule that triggers an AWS Systems Manager Automation runbook to delete older log streams from the CloudWatch Logs log group.

Answer

To configure VPC Flow Logs to deliver to CloudWatch Logs and manage retention, you must create an IAM role with a trust policy that allows the vpc-flow-logs.amazonaws.com service principal to assume the role, and attach a policy with logs:CreateLogStream and logs:PutLogEvents permissions. Additionally, configure the retention setting on the target Amazon CloudWatch Logs log group to 90 days.
The correct options involve creating the delivery IAM role with the correct trust policy (allowing vpc-flow-logs.amazonaws.com to assume the role) and permissions policy (logs:CreateLogStream, logs:PutLogEvents), and configuring the retention period directly on the destination CloudWatch Logs log group.

Step-by-Step Solution

1
Configure the CloudWatch Logs destination retention.
The log group is configured with a 90-day retention policy, ensuring older logs are deleted.
This meets the requirement to delete logs older than 90 days to manage storage costs.
2
Create the delivery IAM role and policies.
An IAM role is created with the trust policy for the vpc-flow-logs.amazonaws.com service principal and permissions for logs:CreateLogStream and logs:PutLogEvents.
This provides the required authorization for the VPC Flow Logs service to publish logs to the log group.
3
Enable the VPC Flow Logs targeting the log group using the created IAM role.
VPC Flow Logs begin publishing network flow data to the destination log group.
This completes the setup of network monitoring.

Key Concept

VPC Flow Logs publication permissions and CloudWatch Logs retention management
Rate this question

Topics

VPC Flow Logs and Network Monitoring

More questions from this topic