Examkin

Question

Difficulty: MediumVPC Security Controls and Traffic Analysis

An organization requires the monitoring of all rejected TCP traffic in a specific VPC. A SysOps Administrator is tasked with creating a VPC Flow Log that publishes to a CloudWatch Logs log group. To minimize operational costs, log data must only be retained for 30 days. Additionally, the administrator must adhere to the principle of least privilege when granting permissions.

Which of the following actions should the administrator perform to successfully establish this monitoring setup? (Select TWO.)

  1. Create an IAM role with a trust relationship that allows the vpc-flow-logs.amazonaws.com service principal to assume the role, and attach a policy allowing log delivery permissions to the log group.Answer
  2. Attach an IAM policy to the administrator's IAM identity that includes the iam:PassRole permission for the resource ARN of the flow logs IAM role.Answer
  3. C
    Define a 30-day data retention period directly within the VPC Flow Log creation settings to automatically clean up old records.
  4. D
    Modify the trust relationship of the flow logs IAM role to allow the administrator's IAM user ARN to assume the role instead of the flow logs service.
  5. E
    Configure an Amazon S3 lifecycle policy directly on the CloudWatch Logs log group to automatically transition and expire log entries after 30 days.

Answer

To successfully set up VPC Flow Logs with CloudWatch Logs and limit retention, the administrator must create an IAM role with a trust relationship allowing the vpc-flow-logs.amazonaws.com service principal to assume the role and attach permissions to write to CloudWatch Logs, and also attach an IAM policy to the administrator's identity granting the iam:PassRole permission for that role.
To configure VPC Flow Logs to publish to CloudWatch Logs, the VPC Flow Logs service principal (vpc-flow-logs.amazonaws.com) must be allowed to assume an IAM role that has write permissions to CloudWatch Logs. Additionally, the administrator who is creating the flow log must have the iam:PassRole permission to assign this role to the service. The retention is managed directly on the CloudWatch Logs log group.

Step-by-Step Solution

1
Configure the CloudWatch Logs log group retention period.
Set the retention of the destination log group to 30 days.
This manages retention and controls costs at the correct log group level.
2
Create and configure the IAM role for VPC Flow Logs.
An IAM role is created with a trust policy for the vpc-flow-logs.amazonaws.com service principal and an execution policy allowing logs:CreateLogStream and logs:PutLogEvents.
This authorizes the VPC Flow Logs service to write logs into the destination CloudWatch Logs log group.
3
Grant iam:PassRole permissions to the administrator's IAM identity.
The administrator's IAM user or group policy allows the iam:PassRole action targeting the ARN of the flow logs IAM role.
This permits the administrator to pass the required role to the flow logs service during flow log creation.

Key Concept

VPC Flow Logs Permission and Log Retention Configuration
Rate this question

Topics

VPC Security Controls and Traffic Analysis

More questions from this topic