A SysOps Administrator is configuring VPC Flow Logs to publish network traffic logs from a VPC to an Amazon CloudWatch Logs log group. The administrator has already created the target log group but receives access errors when attempting to create the flow logs using their IAM user. Which of the following configuration actions are required to successfully establish log delivery? (Select TWO.)
- Configure the trust policy of the IAM delivery role to allow the VPC Flow Logs service principal (vpc-flow-logs.amazonaws.com) to assume the role.Answer
- Attach a policy to the SysOps Administrator's IAM identity that grants the iam:PassRole permission for the flow log delivery role.Answer
- CAdd the iam:PassRole permission to the trust policy of the flow log delivery role itself to authorize user delegation.
- DConfigure the CloudWatch Logs log group's retention period to Never Expire before creating the flow log to prevent initialization timeouts.
- EConfigure an Amazon EventBridge rule that triggers an AWS Systems Manager Automation document to dynamically authorize VPC flow log writes.
Answer
Configure the trust policy of the IAM delivery role to allow the VPC Flow Logs service principal to assume the role, and attach a policy to the SysOps Administrator's IAM identity that grants the iam:PassRole permission for the flow log delivery role.
To publish VPC Flow Logs to CloudWatch Logs, the flow log service requires a role that trusts 'vpc-flow-logs.amazonaws.com' via an assume role policy. Additionally, the administrator who creates the flow log must be granted the 'iam:PassRole' permission on that delivery role to ensure they are authorized to delegate it to the service.
Step-by-Step Solution
Key Concept
To stream VPC Flow Logs to CloudWatch Logs, the service requires an IAM role with a trust policy allowing vpc-flow-logs.amazonaws.com to assume it, and the administrator creating the flow log must possess iam:PassRole permissions for that role.