Examkin

Soru

Zorluk: ZorImproving Operational Excellence via Monitoring and Logging

A retail enterprise operates a high-throughput transaction processing application deployed on a fleet of Amazon EC2 instances across 50 member accounts. The accounts are managed under a single organization in AWS Organizations. The application logs transaction events locally to `/var/log/transactions/app.log`. The files undergo hourly rotation by `logrotate` and are renamed to `/var/log/transactions/app.log-YYYYMMDD-HH`.

A Solutions Architect must design a centralized, near-real-time logging solution to aggregate these application logs into a single Amazon S3 bucket in a dedicated logging account. The solution must minimize log duplication, ensure no logs are lost during rotation, and avoid the administrative overhead of deploying streaming infrastructure in every member account.

Which two configurations should the Solutions Architect implement to meet these requirements?

  1. Configure the CloudWatch agent on the EC2 instances to monitor the exact log file path `/var/log/transactions/app.log` without using wildcards in the configuration.Cevap
  2. In the central logging account, create a Kinesis Data Firehose delivery stream and a CloudWatch Logs destination. Configure the destination policy to permit the `logs:PutSubscriptionFilter` action for the AWS Organization using the `aws:PrincipalOrgID` condition, and create subscription filters in the member accounts targeting this destination.Cevap
  3. C
    Configure the CloudWatch agent on the EC2 instances to monitor the wildcard log path `/var/log/transactions/app.log*` to ensure that rotated log files are captured during the rotation window.
  4. D
    In the central logging account, configure the S3 bucket policy to grant `s3:PutObject` permissions to a wildcard principal (`*`) restricted by the `aws:PrincipalOrgID` condition. In each member account, configure the CloudWatch agent to write logs directly to the central S3 bucket.
  5. E
    Deploy a Kinesis Data Firehose delivery stream in each member account. In the central logging account, configure the S3 bucket policy to grant `s3:PutObject` access to the principal `"arn:aws:iam::*:role/FirehoseDeliveryRole"` to allow all member accounts to deliver logs.

Cevap

Configure the CloudWatch agent on the EC2 instances to monitor the exact log file path without using wildcards, and set up a Kinesis Data Firehose delivery stream and a CloudWatch Logs destination in the central logging account with a policy restricted by the organization ID, while configuring subscription filters in the member accounts.
To ensure operational excellence and avoid duplicate log ingestion during rotation, the CloudWatch agent must be configured with the exact active file path. Because the agent tracks log files via their underlying file descriptors, it automatically handles log rotation without re-reading renamed files. For scalable cross-account centralization, using a centralized CloudWatch Logs destination and Kinesis Data Firehose stream in the logging account avoids deploying streaming resources in every member account. Restricting access using the `aws:PrincipalOrgID` condition secures cross-account log delivery to the central destination while conforming to the principle of least privilege.

Adım Adım Çözüm

1
Configure the CloudWatch agent's file monitoring path.
Set the agent's `file_path` to `/var/log/transactions/app.log` without wildcards.
This enables the agent to track the active file via its inode/file descriptor. When logrotate rotates the file, the agent continues tracking the active file, avoiding re-reading rotated files and preventing duplication.
2
Set up centralized streaming infrastructure in the logging account.
Create a Kinesis Data Firehose delivery stream writing to the central S3 bucket, and create a CloudWatch Logs destination pointing to this stream.
This establishes a central logging entry point, eliminating the need to deploy and manage Kinesis Data Firehose delivery streams in all 50 member accounts.
3
Configure cross-account permissions and subscription filters.
Apply a destination policy using `PutDestinationPolicy` with the `aws:PrincipalOrgID` condition. Create subscription filters in the member accounts targeting the destination ARN.
This securely grants member accounts permission to stream log events to the central destination in real-time under the principle of least privilege.

Anahtar Kavram

CloudWatch Agent log rotation tracking and cross-account log centralization using CloudWatch Logs subscription filters and Kinesis Data Firehose.
Bu soruyu puanla

Konular

Improving Operational Excellence via Monitoring and Logging