An enterprise runs a distributed containerized application across multiple AWS member accounts inside an AWS Organization. The application runs on Amazon EC2 instances in an Auto Scaling group and writes logs directly to `/var/log/app/telemetry-YYYY-MM-DD-HH.log`. These log files are rotated and recreated hourly. A Solutions Architect must design a centralized logging solution to aggregate these logs in near-real-time into an Amazon S3 bucket in a central Security account () for security auditing. The architecture must scale automatically as new member accounts are added to the organization, enforce encryption at rest using an AWS KMS Customer Managed Key (CMK) stored in the Security account, and minimize operational overhead on the instances. Which combination of configuration steps should the Solutions Architect implement to meet these requirements?
- Install the Unified CloudWatch Agent on the EC2 instances in the member accounts. Configure the agent with a `file_path` of `/var/log/app/telemetry-*.log` in the agent configuration file to monitor the hourly log files. In each member account, deploy an Amazon Kinesis Data Firehose delivery stream configured to write to the central S3 bucket in the Security account. In the Security account, configure the S3 bucket policy to grant `s3:PutObject` and `s3:PutObjectAcl` permissions to the member accounts' Firehose IAM roles, using the `aws:PrincipalOrgID` condition. Configure S3 bucket encryption using a Customer Managed Key (CMK) in the Security account, and update the KMS key policy to allow the member accounts' Firehose IAM roles `kms:GenerateDataKey` and `kms:Encrypt` permissions.Cevap
- BInstall the Unified CloudWatch Agent on the EC2 instances in the member accounts. Configure the agent with a static `file_path` of `/var/log/app/telemetry.log` in the agent configuration file. In each member account, deploy an Amazon Kinesis Data Firehose delivery stream configured to write to the central S3 bucket in the Security account. In the Security account, configure the S3 bucket policy to grant `s3:PutObject` and `s3:PutObjectAcl` permissions to the member accounts' Firehose IAM roles, using the `aws:PrincipalOrgID` condition. Configure S3 bucket encryption using a Customer Managed Key (CMK) in the Security account, and update the KMS key policy to allow the member accounts' Firehose IAM roles `kms:GenerateDataKey` and `kms:Encrypt` permissions.
- CInstall the Unified CloudWatch Agent on the EC2 instances in the member accounts. Configure the agent with a `file_path` of `/var/log/app/telemetry-*.log` in the agent configuration file to monitor the hourly log files. In each member account, deploy an Amazon Kinesis Data Firehose delivery stream configured to write to the central S3 bucket in the Security account. In the Security account, configure the S3 bucket policy to grant only `s3:PutObject` permissions to the member accounts' Firehose IAM roles using the `aws:PrincipalOrgID` condition, omitting `s3:PutObjectAcl`. Configure S3 bucket encryption using the default AWS-managed KMS key (`aws/s3`) to simplify key management across accounts.
- DInstall the Unified CloudWatch Agent on the EC2 instances in the member accounts. Configure the agent with a `file_path` of `/var/log/app/telemetry-*.log` in the agent configuration file to monitor the hourly log files. In the member accounts, configure the local CloudWatch Logs log group to stream log events directly to a centralized Kinesis Data Firehose delivery stream in the Security account by specifying the Firehose ARN in the subscription filter. In the Security account, configure the S3 bucket policy to allow the centralized Firehose role access, and configure the S3 bucket to be encrypted using the KMS CMK, without updating the KMS key policy.
Cevap
The correct option is the one specifying the wildcard path in the CloudWatch agent config, deploying Kinesis Data Firehose in each member account, granting S3 write and ACL permissions via the bucket policy using the organizational condition, and updating the Customer Managed Key (CMK) key policy to allow cross-account KMS access.
The correct option configures the CloudWatch Agent with the wildcard path `/var/log/app/telemetry-*.log` to ensure dynamically rotated hourly files are captured. It uses Kinesis Data Firehose in each member account to deliver the logs cross-account. In the Security account, the S3 bucket policy grants both `s3:PutObject` and `s3:PutObjectAcl` (which Firehose requires for cross-account S3 delivery to transfer ownership). It enforces encryption using a Customer Managed Key (CMK) and updates the KMS key policy to permit the member accounts' Firehose roles to encrypt the data, which is not possible using the default AWS-managed KMS key.
Adım Adım Çözüm
Anahtar Kavram
To establish cross-account log centralization using Kinesis Data Firehose and CloudWatch, you must configure a dynamic wildcard path for rotated logs, use a shareable KMS Customer Managed Key (CMK) with cross-account access, and grant both `s3:PutObject` and `s3:PutObjectAcl` permissions on the destination S3 bucket policy.