Examkin

Question

Difficulty: MediumVPC Flow Logs and Network Monitoring

A SysOps Administrator is configuring VPC Flow Logs to capture traffic from a critical production subnet and deliver the logs to an Amazon CloudWatch Logs log group. After creating the flow log, the administrator notices that the log group remains empty and no log streams are generated. The administrator verifies that the flow log status is active but no logs are being delivered.

Which of the following configuration issues are likely causing this problem? (Select TWO.)

  1. The trust policy of the IAM role assigned to the flow log does not list the vpc-flow-logs.amazonaws.com service principal as a trusted entity.Answer
  2. The IAM policy attached to the flow log's IAM role does not grant the logs:CreateLogStream and logs:PutLogEvents permissions for the destination log group.Answer
  3. C
    The target CloudWatch Logs log group has its retention period set to 'Never expire', which prevents new log streams from initializing.
  4. D
    The trust policy of the IAM role is configured with the iam:PassRole action instead of the sts:AssumeRole action to allow the service to assume the role.
  5. E
    The subnets associated with the monitored resources do not have a route to the CloudWatch Logs interface VPC endpoint in their route tables.

Answer

The correct answers are that the IAM role's trust policy must trust the vpc-flow-logs.amazonaws.com service principal, and the policy attached to the role must grant the logs:CreateLogStream and logs:PutLogEvents permissions.
To successfully publish VPC Flow Logs to CloudWatch Logs, the flow log service requires an IAM role. The trust policy of this IAM role must allow the vpc-flow-logs.amazonaws.com service principal to perform the sts:AssumeRole action. Additionally, the permissions policy attached to the role must grant logs:CreateLogStream and logs:PutLogEvents permissions for the target CloudWatch Logs log group. If either of these is missing, VPC Flow Logs will be unable to deliver logs even if the flow log status is active.

Step-by-Step Solution

1
Analyze the IAM role trust policy.
Ensure that the trust relationship allows the VPC Flow Logs service principal (vpc-flow-logs.amazonaws.com) to assume the role.
Without this trust relationship, AWS cannot assume the role to write logs to CloudWatch Logs.
2
Verify the IAM role permissions policy.
Confirm that the role has permissions to create log streams and put log events (logs:CreateLogStream, logs:PutLogEvents) in the target log group.
Even if the role is trusted, it must have the necessary access permissions to write the log data.

Key Concept

VPC Flow Logs requires an IAM role with a trust policy allowing the vpc-flow-logs.amazonaws.com service principal to assume the role, and an attached policy allowing logs:CreateLogStream and logs:PutLogEvents.
Estimated Time:2m 0s
Rate this question

Topics

VPC Flow Logs and Network Monitoring

More questions from this topic