Examkin

Soru

Zorluk: ZorMonitoring and Analyzing Logs with Amazon CloudWatch

A developer is troubleshooting a CloudWatch Logs subscription filter that streams log events from a Lambda function's log group to an Amazon Kinesis Data Firehose delivery stream. The delivery stream successfully writes data to an Amazon S3 bucket, but the developer notices that no logs from the subscription filter are arriving in S3. The CloudWatch metric DeliveryErrors for the subscription filter shows a consistently high count. The developer verifies that the Firehose delivery stream is active and that the IAM role specified in the subscription filter has a permissions policy allowing firehose:PutRecord and firehose:PutRecordBatch on the delivery stream. Which of the following is the most likely cause of this issue?

  1. A
    The CloudWatch Logs log group is missing an IAM resource policy that allows the Kinesis Data Firehose delivery stream to read logs.
  2. B
    The IAM role specified in the subscription filter is missing the logs:PutLogEvents and logs:CreateLogStream permissions required to read the log group.
  3. The trust policy of the IAM role specified in the subscription filter does not list the CloudWatch Logs service principal (logs.amazonaws.com) as a trusted entity.Cevap
  4. D
    The trust policy of the IAM role specified in the subscription filter does not list the Kinesis Data Firehose service principal (firehose.amazonaws.com) as a trusted entity.

Cevap

The trust policy of the IAM role specified in the subscription filter does not list the CloudWatch Logs service principal (logs.amazonaws.com) as a trusted entity.
To stream logs via a subscription filter, CloudWatch Logs must assume the IAM role specified in the subscription filter to write events to Kinesis Data Firehose. If the trust policy of that IAM role does not list the CloudWatch Logs service principal (logs.amazonaws.com) as a trusted entity, the sts:AssumeRole call fails, preventing logs from being delivered and causing DeliveryErrors.

Adım Adım Çözüm

1
Identify the component failing in the log delivery pipeline.
The DeliveryErrors metric for the CloudWatch Logs subscription filter is high, indicating that CloudWatch Logs is unable to write the log events to Kinesis Data Firehose.
Understanding where the failure occurs helps narrow down whether the issue lies within Firehose configuration, IAM permissions, or subscription filter setup.
2
Analyze the IAM permission requirements for CloudWatch Logs subscription filters.
For CloudWatch Logs to push log data to Kinesis Data Firehose, it must assume the IAM role provided in the subscription filter.
This transition requires an sts:AssumeRole operation, which relies on the role's trust policy.
3
Evaluate the trust relationship of the IAM role.
The trust policy of the IAM role must permit the logs.amazonaws.com service principal to assume it.
If the trust policy incorrectly trusts firehose.amazonaws.com or lacks the logs service principal entirely, the assume-role request fails, resulting in delivery errors.

Anahtar Kavram

IAM Role Trust Relationships for CloudWatch Logs Subscription Filters
Bu soruyu puanla

Konular

Monitoring and Analyzing Logs with Amazon CloudWatch

Bu konudan daha fazla soru