Examkin

Soru

Zorluk: ZorImproving Operational Excellence via Monitoring and Logging

An enterprise operates a delivery tracking application deployed across multiple AWS accounts managed under an AWS Organizations organization. The application is hosted on Amazon EC2 instances within Auto Scaling groups. The application writes operational logs locally to `/var/log/delivery/tracking.log`. The logs undergo hourly rotation, during which the active log file is renamed to `/var/log/delivery/tracking.log.YYYY-MM-DD-HH` and a new `tracking.log` is created.

The solutions architect must design a centralized, operationally excellent monitoring and logging architecture. The architecture must gather all application logs and deliver all AWS CloudTrail logs from all member accounts into a single Amazon S3 bucket located in a central security account.

Which combination of steps should the solutions architect take to meet these requirements while ensuring operational reliability and maintaining least-privilege security? (Select TWO.)

  1. Configure the S3 bucket policy in the central security account to grant `s3:PutObject` permissions to the CloudTrail service principal (`cloudtrail.amazonaws.com`), and use the `aws:PrincipalOrgID` condition key to restrict log delivery to only the accounts within the AWS Organization.Cevap
  2. In the Unified CloudWatch Agent configuration file on the EC2 instances, define the log source with the `file_path` parameter set to `/var/log/delivery/tracking.log*` to ensure both the active log and the rotated log files are monitored and streamed.Cevap
  3. C
    In the Unified CloudWatch Agent configuration file on the EC2 instances, set the `file_path` to `/var/log/delivery/tracking.log` and schedule a cron job to restart the CloudWatch agent service hourly immediately after the log rotation occurs.
  4. D
    Attach an AWS Organizations Service Control Policy (SCP) to the organization root that allows `s3:PutObject` on the central S3 bucket, and configure the central S3 bucket policy with a wildcard principal (`*`) to inherit permissions from the SCP.
  5. E
    In the Unified CloudWatch Agent configuration file on the EC2 instances, set the `file_path` to `/var/log/delivery/tracking.log` and set the `publish_multi_line_logs` parameter to `true` to force the agent to follow historical file rotations.

Cevap

The correct combination requires configuring the S3 bucket policy in the central security account to grant write access to the CloudTrail service principal restricted by the Organization ID, and setting the Unified CloudWatch Agent's file path parameter using a wildcard pattern to capture rotated logs.
The solution requires two actions: first, enabling cross-account CloudTrail log delivery securely by configuring the destination S3 bucket policy to allow the CloudTrail service principal while restricting access using the `aws:PrincipalOrgID` condition. Second, configuring the Unified CloudWatch Agent to monitor the application log directory using a wildcard pattern (`/var/log/delivery/tracking.log*`). This wildcard allows the agent to monitor both the active file and any rotated files during the transition window, preventing data loss without requiring service restarts.

Adım Adım Çözüm

1
Configure the central S3 bucket policy for CloudTrail.
The bucket policy allows `cloudtrail.amazonaws.com` to perform `s3:PutObject` with a condition evaluating `aws:PrincipalOrgID` matching the organization's ID.
This establishes secure cross-account log delivery for all current and future accounts in the AWS Organization without manually updating bucket policies.
2
Configure the CloudWatch Agent configuration file on EC2 instances.
The `file_path` configuration under the log section uses the wildcard pattern `/var/log/delivery/tracking.log*`.
The wildcard ensures that when `tracking.log` is rotated to `tracking.log.YYYY-MM-DD-HH`, the agent continues tracking the renamed file until it reaches EOF and automatically starts tracking the newly created `tracking.log`.

Anahtar Kavram

Improving operational excellence involves implementing secure, automated, and resilient centralization of both infrastructure audit trails and application-level log streams across multi-account environments.
Bu soruyu puanla

Konular

Improving Operational Excellence via Monitoring and Logging