Examkin

Question

Difficulty: HardTroubleshooting Monitoring, Logging, and Permissions

An organization configures Amazon CloudWatch Logs subscription filters to stream log events to an Amazon Kinesis Data Firehose delivery stream. The delivery stream writes the log data to a destination Amazon S3 bucket. Both the delivery stream and the destination S3 bucket are encrypted using a Customer Managed Key (CMK) managed by AWS Key Management Service (AWS KMS). The SysOps Administrator observes that the S3 bucket is empty and log delivery has failed. Which of the following troubleshooting steps should the administrator perform to resolve this issue? (Select TWO.)

  1. Configure the IAM policy attached to the CloudWatch Logs role to allow the firehose:PutRecord action on the delivery stream and the kms:GenerateDataKey action on the KMS key used by Kinesis Data Firehose.Answer
  2. Configure the KMS key policy of the S3 bucket's encryption key to grant the Kinesis Data Firehose delivery role permissions to perform the kms:GenerateDataKey and kms:Encrypt actions.Answer
  3. C
    Change the log group retention settings to Never Expire to prevent log events from being deleted before Kinesis Data Firehose can pull them from the log group.
  4. D
    Enable detailed monitoring on the instances generating the log data to increase the delivery frequency of the subscription filter from 5 minutes to 1 minute.
  5. E
    Add iam:PassRole permissions to the Kinesis Data Firehose delivery role trust policy to allow the S3 service principal to assume the role.

Answer

Configure the IAM policy attached to the CloudWatch Logs role to allow the firehose:PutRecord action on the delivery stream and the kms:GenerateDataKey action on the KMS key used by Kinesis Data Firehose, and configure the KMS key policy of the S3 bucket's encryption key to grant the Kinesis Data Firehose delivery role permissions to perform the kms:GenerateDataKey and kms:Encrypt actions.
The correct troubleshooting actions involve ensuring that CloudWatch Logs has permissions to write to the encrypted Kinesis Data Firehose stream (which requires both the firehose:PutRecord action and the kms:GenerateDataKey action on the stream's encryption key), and ensuring that the Firehose delivery role has permissions to write to the encrypted S3 bucket (which requires the kms:GenerateDataKey and kms:Encrypt actions on the bucket's KMS key policy).

Step-by-Step Solution

1
Verify CloudWatch Logs permissions to write to Kinesis Data Firehose.
Ensure the CloudWatch Logs subscription role includes firehose:PutRecord permissions.
CloudWatch Logs needs direct write permissions to deliver log records into the Kinesis Data Firehose stream.
2
Analyze KMS permissions for Kinesis Data Firehose ingestion.
Ensure the CloudWatch Logs role is granted kms:GenerateDataKey on the Customer Managed Key (CMK) encrypting Kinesis Data Firehose.
Since the stream is encrypted, writing to it requires generating data keys using the stream's KMS key.
3
Analyze KMS permissions for Kinesis Data Firehose S3 delivery.
Update the S3 bucket's KMS key policy to permit the Kinesis Data Firehose delivery role to perform kms:GenerateDataKey and kms:Encrypt.
Firehose must be able to generate encryption keys and encrypt data objects before uploading them to the encrypted S3 bucket.

Key Concept

Troubleshooting CloudWatch Logs subscription filter delivery issues involving AWS KMS key policies and IAM service permissions.
Rate this question

Topics

Troubleshooting Monitoring, Logging, and Permissions

More questions from this topic