Examkin

Question

Difficulty: EasySecurity Monitoring, Logging, and Compliance Auditing

A SysOps Administrator is configuring AWS CloudTrail to send log events to Amazon CloudWatch Logs for real-time monitoring of security group changes. Which TWO configurations are required to successfully enable this log delivery? (Select TWO.)

  1. An IAM role with a trust policy that allows the AWS CloudTrail service principal to assume the roleAnswer
  2. An IAM policy attached to the role that grants permissions to perform the logs:CreateLogStream and logs:PutLogEvents actions on the target log groupAnswer
  3. C
    Detailed monitoring enabled on the target CloudWatch Logs log group to allow real-time 1-minute log retrieval
  4. D
    An Amazon EventBridge rule configured to route API events from CloudTrail to the CloudWatch Logs log group
  5. E
    A CloudWatch Logs log group retention setting configured to 'Never expire' to prevent CloudTrail from stopping delivery when the log group is full

Answer

To successfully enable AWS CloudTrail log delivery to Amazon CloudWatch Logs, an IAM role must be created with a trust policy that allows the CloudTrail service principal to assume the role, and this role must have a permissions policy that allows the logs:CreateLogStream and logs:PutLogEvents actions on the target log group.
To deliver logs from AWS CloudTrail to a CloudWatch Logs log group, CloudTrail must assume an IAM role. The role must have a trust policy allowing 'cloudtrail.amazonaws.com' to assume it. Additionally, the role's permissions policy must allow the logs:CreateLogStream and logs:PutLogEvents actions so that the service can write logs into the log group.

Step-by-Step Solution

1
Configure the trust policy of the IAM role to allow assume role permissions for the CloudTrail service principal.
The CloudTrail service gains the ability to assume the specified IAM role.
CloudTrail needs to assume a role in the customer account to deliver logs to resources like CloudWatch Logs log groups.
2
Attach a policy to the IAM role that allows the logs:CreateLogStream and logs:PutLogEvents permissions for the CloudWatch Logs log group resource.
The assumed role has permissions to create streams and publish log events to the log group.
Without these permissions, the CloudTrail service will fail to write the log events into the log group.

Key Concept

AWS CloudTrail integration with CloudWatch Logs requires a service-linked or user-configured IAM role with trust relationships and write permissions to the destination log group.
Rate this question

Topics

Security Monitoring, Logging, and Compliance Auditing

More questions from this topic