Examkin

Soru

Zorluk: OrtaImproving Operational Excellence via Monitoring and Logging

A gaming company is running a multiplayer game platform on a fleet of Amazon EC2 instances across multiple AWS accounts within AWS Organizations. The game server application writes performance metrics and access logs to `/opt/gameserver/logs/server.log`, which is rotated and renamed to `/opt/gameserver/logs/server.log.timestamp` every hour. The company wants to centralize these application logs in Amazon CloudWatch Logs for real-time analysis. Additionally, they must store all CloudTrail logs from all member accounts in a single Amazon S3 bucket within a dedicated auditing account.

Which of the following actions should the Solutions Architect take to implement this monitoring and logging setup? (Select TWO.)

  1. Install the Amazon CloudWatch agent on the EC2 instances and configure the log path in the agent configuration using a wildcard pattern such as '/opt/gameserver/logs/server.log*' to capture rotated files.Cevap
  2. In the auditing account, update the S3 bucket policy to grant 's3:PutObject' permission to the CloudTrail service principal 'cloudtrail.amazonaws.com' with a condition that checks the 'aws:PrincipalOrgID' key against the organization ID.Cevap
  3. C
    Install the Amazon CloudWatch agent on the EC2 instances and configure the log path statically as '/opt/gameserver/logs/server.log', relying on the agent to track file descriptors during rotation.
  4. D
    Configure the S3 bucket policy in the auditing account to allow 's3:PutObject' from all principals ('*') and rely on AWS Organizations Service Control Policies (SCPs) to restrict write access to the organization's member accounts.
  5. E
    Enable log encryption using the default AWS-managed KMS key 'aws/s3' or 'aws/cloudtrail' and configure its key policy to allow cross-account access to all member accounts in the organization.

Cevap

Install the Amazon CloudWatch agent on the EC2 instances and configure the log path using a wildcard pattern such as '/opt/gameserver/logs/server.log*' to capture rotated files, and update the S3 bucket policy in the auditing account to grant 's3:PutObject' permission to the CloudTrail service principal with a condition checking 'aws:PrincipalOrgID' against the organization ID.
Configuring the Amazon CloudWatch agent log path with a wildcard pattern ensures that the agent monitors and ingests both active and rotated log files. To allow the CloudTrail service to write logs from all accounts in the organization to a central S3 bucket, the S3 bucket policy must grant 's3:PutObject' permission to the CloudTrail service principal ('cloudtrail.amazonaws.com') and enforce organization-wide boundaries using the 'aws:PrincipalOrgID' condition key.

Adım Adım Çözüm

1
Address the log rotation monitoring requirement by configuring the CloudWatch agent on the EC2 instances.
Use a wildcard pattern like `/opt/gameserver/logs/server.log*` in the agent configuration file to ensure the agent picks up the active log file as well as rotated files.
A static path configuration fails when files are renamed during rotation, causing the agent to miss logs.
2
Address the centralized cross-account CloudTrail logging requirement by updating the destination S3 bucket policy.
Grant `s3:PutObject` permission to the `cloudtrail.amazonaws.com` service principal and add a condition checking `aws:PrincipalOrgID` matching the organization's ID.
This allows CloudTrail to write logs from all member accounts in the organization while preventing unauthorized writes from external accounts.

Anahtar Kavram

Centralizing multi-account application and governance logs using the CloudWatch agent and S3 bucket policies with AWS Organizations.
Bu soruyu puanla

Konular

Improving Operational Excellence via Monitoring and Logging