A company is configuring centralized logging and monitoring for its multi-account environment managed by AWS Organizations. The goal is to collect application logs from Amazon EC2 instances in various application accounts and deliver them to a central S3 bucket in a dedicated Security account. On the EC2 instances, the application logs are rotated hourly. Additionally, the company needs to collect memory utilization metrics from the EC2 instances. Which two configurations are required to meet these requirements?
- Configure the Unified CloudWatch Agent on the EC2 instances using a wildcard path pattern such as /var/log/app/*.log to capture both active and rotated logs, and include the memory metrics under the metrics section of the agent configuration file.Cevap
- Apply a bucket policy to the centralized S3 bucket in the Security account that grants s3:PutObject permissions to the application accounts, specifying a condition that restricts access to the AWS Organization ID.Cevap
- CConfigure the Unified CloudWatch Agent to monitor only the static path /var/log/app/current.log, assuming that the agent will automatically detect and follow the log rotation using default Linux file descriptors.
- DConfigure the central S3 bucket with a bucket policy that grants read and write access to all principals, and use S3 block public access to prevent external access instead of specifying the Organization ID.
- EEnable encryption on the centralized S3 bucket using the default AWS-managed KMS key aws/s3 to automatically encrypt cross-account log objects sent from the application accounts.
Cevap
Configure the Unified CloudWatch Agent with wildcard paths and memory metrics, and apply an S3 bucket policy in the central security account allowing writes from the organization.
The correct configuration requires configuring the Unified CloudWatch Agent with wildcard path patterns to collect rotated logs and memory metrics, and applying a bucket policy on the centralized S3 bucket that permits write access to the AWS Organization's accounts using the organizational ID condition.
Adım Adım Çözüm
Anahtar Kavram
Operational Excellence via centralized logging and monitoring involves configuring agents to handle rotated log patterns and setting up secure cross-account permissions on destination buckets.