An enterprise operates a legacy monolithic application deployed on a fleet of Amazon EC2 instances across multiple member accounts in an AWS Organizations organization. The application writes log events to a local file at `/var/log/app/app.log`. A local cron utility rotates these logs hourly, renaming the active file to `/var/log/app/app.log.YYYY-MM-DD-HH` and compressing it. A solutions architect needs to design a centralized logging solution to stream these logs to a central Amazon S3 bucket in a dedicated logging account for audit compliance and near-real-time security analysis. Which combination of steps should the solutions architect take to implement this solution? (Choose two.)
- Configure the Amazon CloudWatch agent on the EC2 instances with the log file path set to `/var/log/app/app.log*` in the agent configuration JSON to ensure all active and rotated log files are tracked.Cevap
- Configure a Kinesis Data Firehose delivery stream in each application account to deliver logs to the central S3 bucket, and update the central S3 bucket policy to explicitly grant `s3:PutObject` permissions to the IAM role ARN of each cross-account delivery stream.Cevap
- CConfigure the Amazon CloudWatch agent on the EC2 instances with the log file path set strictly to `/var/log/app/app.log`, relying on the agent to automatically follow file descriptor changes and detect the rotated files.
- DConfigure the central S3 bucket policy to grant `s3:PutObject` access to the Kinesis Data Firehose service principal (`firehose.amazonaws.com`) without specifying the individual cross-account IAM role ARNs.
- EConfigure the EC2 instances to write logs directly to a local S3 bucket in each account, and configure S3 Cross-Region Replication (CRR) to replicate the log objects to the central S3 bucket in the logging account.
Cevap
Configure the CloudWatch agent with the wildcard file path `/var/log/app/app.log*` to capture rotated logs, and configure a Kinesis Data Firehose stream in each account to deliver logs to the central S3 bucket with an S3 bucket policy explicitly granting write permissions to the Firehose IAM roles.
To ensure reliable log streaming and central archiving, the solutions architect must configure the CloudWatch agent with a wildcard pattern (e.g., `/var/log/app/app.log*`) to monitor files across rotations. In addition, the central S3 bucket policy must explicitly grant `s3:PutObject` access to the specific IAM roles assumed by the Kinesis Data Firehose streams in each member account to allow cross-account log delivery.
Adım Adım Çözüm
Anahtar Kavram
Configuring the CloudWatch agent with wildcards to handle log rotation, and setting up cross-account S3 bucket policies for Kinesis Data Firehose log delivery.
Tahmini Süre:3m 0s