Examkin

Soru

Zorluk: ZorImproving Operational Excellence via Monitoring and Logging

A media streaming platform runs its transaction processing workload on a fleet of Amazon EC2 instances managed by an Auto Scaling group across multiple AWS accounts in an organization. The application outputs transactional logs to `/var/log/checkout/transaction.log`. These logs are rotated hourly and renamed using the pattern `/var/log/checkout/transaction-YYYY-MM-DD-hh.log`. A Solutions Architect must design a solution to centralize these logs into a dedicated Amazon S3 bucket within a security account. The solution must ensure that log rotation does not interrupt log collection or result in duplicate log entries, and must enforce strict cross-account security controls. Which two of the following actions should the Solutions Architect perform to meet these requirements? (Select TWO.)

  1. Configure the log files collector in the Amazon CloudWatch agent configuration on the EC2 instances to monitor `/var/log/checkout/transaction*.log`, allowing the agent to track file state and process both current and rotated logs without data loss.Cevap
  2. In the security account, configure a CloudWatch Logs destination mapping to an Amazon Kinesis Data Firehose delivery stream that targets the central S3 bucket. Apply an access policy to the destination that trusts the member accounts, restricted by the `aws:PrincipalOrgID` condition key.Cevap
  3. C
    Configure the log files collector in the Amazon CloudWatch agent configuration on the EC2 instances to target `/var/log/checkout/transaction.log` as a static file, relying on the agent's default behavior to automatically re-open and detect files when they are renamed during rotation.
  4. D
    Set up the destination S3 bucket policy in the security account to allow write actions from the member accounts' roles, but omit the specific service principal for CloudWatch Logs and the organizational constraints, relying on account-level bucket sharing instead.
  5. E
    Implement subscription filters in the member accounts to stream logs directly to the security account's S3 bucket, utilizing the default AWS-managed KMS key (`aws/s3`) to handle cross-account data encryption in transit.

Cevap

Configuring the log files collector in the CloudWatch agent to monitor with wildcards, and establishing a centralized CloudWatch Logs destination in the security account linked to Kinesis Data Firehose.
To monitor rotated log files without data loss, the CloudWatch agent must be configured with a wildcard pattern so that it tracks the file descriptor even after rotation and renaming. To centralize logs across accounts, CloudWatch Logs subscription filters must route logs to a centralized CloudWatch Logs destination in the security account, which then feeds into Kinesis Data Firehose to write to S3. Restricting this destination using the organization's ID ensures only authorized member accounts can deliver logs.

Adım Adım Çözüm

1
Configure the CloudWatch Agent with wildcards.
The agent tracks file state and handles rotated log files without loss or duplication.
The wildcard pattern ensures renamed log files are continuously processed.
2
Set up a cross-account CloudWatch Logs destination in the central security account.
Member accounts can safely route subscription streams.
CloudWatch Logs subscription filters cannot write directly to cross-account S3 buckets and must target a destination.
3
Apply security policies with organizational restrictions.
The destination policy allows the organization to write to Firehose/S3 while blocking unauthorized access.
Secures log ingestion from only within the organization.

Anahtar Kavram

Centralized, secure cross-account logging with support for log rotation mechanisms.
Bu soruyu puanla

Konular

Improving Operational Excellence via Monitoring and Logging