Examkin

Soru

Zorluk: OrtaImproving Operational Excellence via Monitoring and Logging

A medical technology company operates a critical patient telemetry application running on Amazon EC2 instances in an Auto Scaling group across multiple AWS member accounts. The application writes log data to `/var/log/telemetry/active.log`. Due to high write volume, these log files are rotated and renamed hourly to `/var/log/telemetry/active.log.YYYY-MM-DD-HH` using a local utility. The company needs to centralize these application logs into a single Amazon S3 bucket located in a dedicated monitoring account for long-term retention and security analysis. The solution must ensure that logs are continuously delivered even immediately after rotation, must support encryption at rest in the destination bucket using a customer-managed key, and must scale efficiently with minimum administrative overhead. Which solutions architecture meets these requirements?

  1. Install the unified Amazon CloudWatch agent on the EC2 instances. In the agent configuration, specify the log file path using the wildcard pattern `/var/log/telemetry/active.log*` to match the rotated files. Configure the agent to stream the logs to a local Amazon CloudWatch log group. Set up a CloudWatch subscription filter in each member account to stream the logs to an Amazon Kinesis Data Firehose delivery stream in the monitoring account, which writes the logs to the central S3 bucket using a Customer Managed KMS key for SSE-KMS encryption.Cevap
  2. B
    Install the unified Amazon CloudWatch agent on the EC2 instances. In the agent configuration, specify the static log file path `/var/log/telemetry/active.log`. Configure the agent to stream the logs to a local Amazon CloudWatch log group, and configure a cron job on the instances to restart the CloudWatch agent service hourly immediately after the log rotation occurs. Use a CloudWatch subscription filter in each member account to stream the logs to an Amazon Kinesis Data Firehose delivery stream in the monitoring account, which writes them to the central S3 bucket encrypted with a Customer Managed KMS key.
  3. C
    Install the unified Amazon CloudWatch agent on the EC2 instances. In the agent configuration, specify the log file path using the wildcard pattern `/var/log/telemetry/active.log*`. Configure the agent to write the logs directly to the central S3 bucket in the monitoring account. Enable SSE-KMS encryption on the bucket using the default AWS-managed key `aws/s3` in the monitoring account, and apply a bucket policy that grants cross-account write access to the EC2 IAM role without specifying an AWS Organizations condition.
  4. D
    Configure Amazon CloudTrail in each member account to monitor the application log files on the EC2 instances and write the logs directly to the central S3 bucket in the monitoring account. Apply the default S3 bucket policy in the monitoring account, and ensure the CloudTrail service in each member account is authorized using the default AWS-managed KMS key `aws/s3` for cross-account encryption.

Cevap

Install the unified Amazon CloudWatch agent on the EC2 instances using a wildcard pattern for the log file path, stream the logs to local CloudWatch log groups, and use subscription filters to forward the logs to a central Kinesis Data Firehose delivery stream in the monitoring account that writes to the S3 bucket with Customer Managed KMS encryption.
The correct architecture uses the unified CloudWatch agent configured with a wildcard pattern to ensure log rotation does not interrupt log ingestion. Streaming to local CloudWatch log groups and forwarding via subscription filters to a central Kinesis Data Firehose delivery stream in the monitoring account provides a secure, highly scalable, and low-latency pipeline. Using a Customer Managed Key for SSE-KMS ensures that cross-account access can be configured via key policies.

Adım Adım Çözüm

1
Configure the CloudWatch agent log path with a wildcard pattern.
The agent continuously tracks and streams the active log file as well as any rotated log files with timestamp suffixes, preventing log delivery gaps.
Rotated logs will be renamed, and a static path would cause the agent to stop reading the rotated logs once the file handles change.
2
Use CloudWatch subscription filters to forward logs to Kinesis Data Firehose.
Local CloudWatch log streams are automatically aggregated and sent across accounts to Kinesis Data Firehose in the monitoring account.
This avoids direct cross-account S3 write complications from EC2 and provides a scalable, managed delivery pipeline.
3
Configure Kinesis Data Firehose to write to S3 with SSE-KMS using a Customer Managed Key.
Logs are encrypted at rest in the central S3 bucket using a key whose policy permits the cross-account Firehose and security roles.
AWS-managed KMS keys do not support policy modification and cannot be shared cross-account, necessitating a Customer Managed Key.

Anahtar Kavram

Continuous operational monitoring and secure cross-account log centralization using CloudWatch agents, subscription filters, and managed keys.
Bu soruyu puanla

Konular

Improving Operational Excellence via Monitoring and Logging