Examkin

Question

Difficulty: MediumVPC Security Controls and Traffic Analysis

A SysOps Administrator is setting up VPC Flow Logs to capture traffic from a public subnet and publish it to an Amazon CloudWatch Logs log group. The administrator creates a dedicated IAM service role for the flow logs, but when attempting to enable the flow log, they receive an "Access Denied" error. Additionally, the administrator wants to minimize long-term storage costs by ensuring that the collected flow log data is automatically deleted after 30 days. Which combination of actions must the administrator take to successfully activate the flow logs and meet the retention requirement? (Select TWO.)

  1. Grant the administrator's IAM identity the iam:PassRole permission for the VPC Flow Logs service role.Answer
  2. Configure the retention settings of the CloudWatch Logs log group to expire events after 30 days.Answer
  3. C
    Grant the administrator's IAM identity the sts:AssumeRole permission for the VPC Flow Logs service role.
  4. D
    Create an Amazon S3 Lifecycle policy on the CloudWatch Logs log group to transition objects to Glacier after 30 days.
  5. E
    Update the public subnet's Network ACL rules to allow outbound HTTPS (port 443) traffic to the CloudWatch Logs endpoint.

Answer

To resolve the issue and meet the requirements, the administrator must grant their IAM identity the iam:PassRole permission for the VPC Flow Logs service role and configure the retention settings of the CloudWatch Logs log group to expire events after 30 days.
The correct options are the ones stating to grant the administrator's IAM identity the iam:PassRole permission for the VPC Flow Logs service role, and to configure the retention settings of the CloudWatch Logs log group to expire events after 30 days. The iam:PassRole permission is required whenever an administrator associates an IAM service role with a resource or service configuration. Setting the log group retention policy to 30 days ensures that CloudWatch automatically deletes older log events to prevent indefinite storage fees.

Step-by-Step Solution

1
Address the Access Denied error during flow log creation.
Identify that the administrator's IAM user or role lacks the iam:PassRole permission to associate the flow logs service role with the VPC flow log configuration.
AWS services require the iam:PassRole permission to verify that a user is authorized to pass a specific service role to an AWS service.
2
Resolve the permission issue by updating the administrator's IAM policy.
Add the iam:PassRole action targeting the Amazon Resource Name (ARN) of the VPC Flow Logs service role to the administrator's policy.
This allows the administrator to delegate the necessary permissions to the VPC Flow Logs service.
3
Configure data retention on the destination to control storage costs.
Update the retention period of the CloudWatch Logs log group from 'Never Expire' to '30 days'.
This ensures that old log data is automatically deleted after 30 days, avoiding indefinite storage charges.

Key Concept

VPC Flow Logs require an IAM role to publish to CloudWatch Logs. Creating this flow log configuration requires the creator to have the iam:PassRole permission. Furthermore, log retention settings must be configured at the CloudWatch Logs log group level to manage data storage costs, as logs do not traverse customer NACLs during out-of-band delivery.
Rate this question

Topics

VPC Security Controls and Traffic Analysis

More questions from this topic