Examkin

Question

Difficulty: Very hardTroubleshooting Monitoring, Logging, and Permissions

A SysOps Administrator is troubleshooting an Amazon EC2 instance in a private subnet that is unable to send application logs to Amazon CloudWatch Logs. The unified CloudWatch agent is installed on the instance, and an interface VPC endpoint for CloudWatch Logs (`com.amazonaws.us-east-1.logs`) is deployed in the VPC. The CloudWatch agent log file on the instance shows repeated connection timeouts when attempting to reach the CloudWatch Logs service endpoint.

Which TWO configurations should the administrator verify to resolve these connection timeouts? (Select TWO.)

  1. Verify that the security group attached to the interface VPC endpoint allows inbound TCP port 443 traffic from the security group of the EC2 instance.Answer
  2. Verify that the VPC has both 'Enable DNS resolution' and 'Enable DNS hostnames' set to true to ensure the standard CloudWatch Logs service endpoint resolves to the private IP addresses of the interface VPC endpoint.Answer
  3. C
    Verify that the EC2 instance profile has the `iam:PassRole` permission to pass the CloudWatch agent service role to the interface VPC endpoint.
  4. D
    Verify that the Amazon S3 bucket policy associated with the VPC gateway endpoint allows the `s3:PutObject` action from the EC2 instance profile role.
  5. E
    Verify that the retention policy of the destination CloudWatch log group is set to 'Never Expire' to allow the agent to initialize a new log stream.

Answer

Verify that the security group attached to the interface VPC endpoint allows inbound TCP port 443 traffic from the EC2 instance's security group, and verify that the VPC has 'Enable DNS resolution' and 'Enable DNS hostnames' set to true.
The connection timeouts indicate that the CloudWatch agent is unable to reach the CloudWatch Logs service endpoint. Because the EC2 instance is located in a private subnet without internet access, it must use the interface VPC endpoint (`com.amazonaws.us-east-1.logs`) to route its traffic privately. To achieve this, two conditions must be met: first, the security group of the VPC endpoint must permit inbound HTTPS (port 443) traffic from the EC2 instance's security group. Second, the VPC must have both 'Enable DNS resolution' and 'Enable DNS hostnames' enabled so that the standard CloudWatch Logs regional domain (e.g., `logs.us-east-1.amazonaws.com`) resolves to the private IP addresses of the interface endpoint instead of the public internet addresses.

Step-by-Step Solution

1
Analyze the error symptoms in the scenario.
The agent logs show connection timeouts, which points to a network routing or firewall issue rather than an IAM permission policy issue.
Connection timeouts occur when the client cannot establish a TCP handshake with the target endpoint.
2
Check the security group configuration of the interface VPC endpoint.
Ensure that the security group attached to the interface VPC endpoint allows inbound HTTPS (port 443) traffic from the EC2 instance's security group.
Interface VPC endpoints act as elastic network interfaces (ENIs) inside the VPC and are protected by security groups.
3
Verify DNS settings within the VPC.
Confirm that the VPC has 'Enable DNS resolution' and 'Enable DNS hostnames' enabled, allowing Private DNS on the endpoint to function.
Without Private DNS, the agent resolves the public endpoint address and fails to connect, as it resides in a private subnet with no internet route.

Key Concept

VPC Endpoint Connectivity and Private DNS Resolution for CloudWatch Logs
Rate this question

Topics

Troubleshooting Monitoring, Logging, and Permissions

More questions from this topic