Examkin

Question

Difficulty: HardVPC Flow Logs and Network Monitoring

A SysOps Administrator is configuring VPC Flow Logs to monitor network traffic for security compliance. The flow logs must be published to a new Amazon CloudWatch Logs log group. Any high-frequency network rejections should trigger an automated system teardown via an AWS Systems Manager (SSM) Automation runbook. The administrator attempts to configure the workflow but encounters two issues: they receive an access denied error when attempting to create the flow log, and the SSM Automation runbook is not being triggered during simulated network rejection events. Which of the following actions should the SysOps Administrator take to successfully configure the flow log delivery and the automated remediation path? (Select TWO).

  1. Attach an IAM policy to the SysOps Administrator's identity that grants the iam:PassRole permission for the IAM role associated with the flow log.Answer
  2. Configure a CloudWatch metric filter to extract REJECT patterns, associate it with a CloudWatch alarm, and create an Amazon EventBridge rule that triggers the Systems Manager Automation runbook when the alarm changes to the ALARM state.Answer
  3. C
    Modify the trust policy of the flow logs IAM role to allow the SysOps Administrator's IAM user to perform the sts:AssumeRole action.
  4. D
    Configure the CloudWatch Logs metric filter to directly trigger the Systems Manager Automation runbook as its target.
  5. E
    Set the log retention policy directly inside the VPC Flow Log configuration settings to automatically delete logs older than 14 days.

Answer

Attach an IAM policy to the SysOps Administrator's identity that grants the iam:PassRole permission for the IAM role associated with the flow log, and configure a CloudWatch metric filter to extract REJECT patterns, associate it with a CloudWatch alarm, and create an Amazon EventBridge rule that triggers the Systems Manager Automation runbook when the alarm changes to the ALARM state.
To create a VPC Flow Log targeting CloudWatch Logs, the IAM identity performing the configuration must be granted the 'iam:PassRole' permission on the role that VPC Flow Logs will assume to deliver the logs. To establish the remediation workflow, raw log data must first be transformed into metrics via a CloudWatch Logs metric filter, which is then mapped to a CloudWatch alarm. An EventBridge rule is then configured to listen for the alarm state changes and trigger the Systems Manager Automation runbook.

Step-by-Step Solution

1
Add the iam:PassRole permission to the administrator's IAM identity.
The SysOps Administrator is authorized to associate the flow logs service role with the new flow log configuration, resolving the access denied error.
When creating a resource that requires a service role, AWS checks if the calling identity is permitted to pass that role to the service.
2
Create a metric filter on the CloudWatch log group searching for the term 'REJECT'.
A custom metric tracking the number of rejected packets is generated.
A metric filter must extract data from the raw text stream of VPC Flow Logs before alarms can be configured.
3
Create a CloudWatch alarm on the custom metric and route its state changes through EventBridge to target the SSM Automation runbook.
The EventBridge rule successfully intercepts the transition to the ALARM state and executes the remediation runbook.
Metric filters cannot directly execute remediation targets; they require an alarm state change event captured by Amazon EventBridge to invoke Systems Manager Automation.

Key Concept

VPC Flow Logs publishing to CloudWatch Logs requires appropriate iam:PassRole permissions for the configuring administrator, and automated remediation requires routing log-derived metrics through CloudWatch Alarms and EventBridge.
Rate this question

Topics

VPC Flow Logs and Network Monitoring

More questions from this topic