Examkin

Soru

Zorluk: OrtaImproving Operational Excellence via Monitoring and Logging

A logistics company is deploying a new shipping coordination platform on Amazon EC2 instances in a dedicated Production AWS account. The platform belongs to an AWS Organization. The Solutions Architect must design a logging solution that achieves the following:
1. Collects application transaction logs from the EC2 instances. The application writes logs to `/var/log/shipping/transaction.log`, which are rotated hourly and renamed with a timestamp suffix (e.g., `/var/log/shipping/transaction.log.2026-07-16-11`). These logs must be sent to Amazon CloudWatch Logs.
2. Tracks all API activity in the Production account and centralizes these logs in a secure Amazon S3 bucket located in a separate Audit AWS account within the organization.

An organizational trail has been configured in the management account to write logs to the central S3 bucket in the Audit account.

Which two configurations are required to ensure both application logs are correctly collected without data loss and API logs are successfully delivered to the Audit account? (Select TWO.)

  1. Configure the CloudWatch agent on the EC2 instances with the log file path set to `/var/log/shipping/transaction.log*` in the agent configuration file.Cevap
  2. Apply an S3 bucket policy to the centralized S3 bucket in the Audit account that allows the `s3:PutObject` action, specifying `cloudtrail.amazonaws.com` as the Principal and containing a condition matching the AWS Organization ID.Cevap
  3. C
    Configure the CloudWatch agent on the EC2 instances with the log file path set to `/var/log/shipping/transaction.log` in the agent configuration file.
  4. D
    Apply an S3 bucket policy to the centralized S3 bucket in the Audit account that allows the `s3:PutObject` action, specifying the Production AWS account ID as the Principal.
  5. E
    Configure the centralized S3 bucket to use the default AWS-managed key `aws/s3` for server-side encryption to automatically encrypt the incoming log files from all organization accounts.

Cevap

To collect the rotated application logs without data loss, the CloudWatch agent must be configured with a wildcard path (`/var/log/shipping/transaction.log*`). To allow cross-account organizational CloudTrail delivery, the S3 bucket policy must permit the `s3:PutObject` action to the `cloudtrail.amazonaws.com` service principal, restricted by the Organization ID.
The configuration using the wildcard path `/var/log/shipping/transaction.log*` is correct because it allows the CloudWatch agent to continue tracking and processing logs that have been rotated and renamed before delivery completes. The configuration applying an S3 bucket policy with `cloudtrail.amazonaws.com` as the principal and an Organization ID condition is correct because organizational trail log delivery is performed by the CloudTrail service principal, which needs explicit write access restricted to the organization's boundary.

Adım Adım Çözüm

1
Address the log rotation requirement for the CloudWatch agent.
Identify that files rotated hourly and renamed with a timestamp suffix require a wildcard suffix in the CloudWatch agent configuration's `file_path` property to prevent data loss.
Without a wildcard, the agent will only monitor the active file and may miss log lines during the rotation process when the file is renamed.
2
Address the cross-account organizational trail delivery to the centralized S3 bucket.
Determine that the S3 bucket policy must grant write permissions to the AWS service principal `cloudtrail.amazonaws.com` and use the `aws:PrincipalOrgID` condition to restrict access to the organization.
CloudTrail writes logs as a service. Granting permission to individual member accounts' root ARNs or IDs as the Principal is incorrect and will block log delivery.
3
Verify KMS key and encryption constraints.
Ensure that if encryption is configured, it does not use the default AWS-managed KMS key since it cannot support cross-account policies.
Cross-account AWS services like CloudTrail writing to an encrypted bucket in another account require a customer managed key with custom key policy permissions.

Anahtar Kavram

To achieve operational excellence in multi-account logging, log agents must be configured to handle log rotation patterns with wildcards, and centralized storage buckets must utilize service-principal-based policies with organizational boundaries.
Bu soruyu puanla

Konular

Improving Operational Excellence via Monitoring and Logging