A media streaming company runs a critical content delivery API on Amazon EC2 instances in an Auto Scaling group across multiple member accounts in an AWS Organization. The API logs are written to `/var/log/api/server.log` and are rotated hourly to `/var/log/api/server.log.YYYY-MM-DD-HH`. To meet compliance requirements, a solutions architect must design a centralized logging solution that aggregates these logs into an Amazon S3 bucket in a dedicated Security account. The solution must minimize log data loss during rotations and support near-real-time streaming. Which combination of steps should the solutions architect implement to achieve these operational excellence goals?
- Install the unified CloudWatch agent on the EC2 instances. In the agent configuration file, set the log path to `/var/log/api/server.log*`. Configure the agent to publish logs to a local CloudWatch Logs log group. In the Security account, create a centralized Kinesis Data Firehose delivery stream that writes to the S3 bucket, encrypted with a Customer Managed Key (CMK). In the Security account, create a CloudWatch Logs destination with a policy that grants permission to the AWS Organization ID, and associate it with the Firehose stream. In the member accounts, create a CloudWatch Logs subscription filter pointing to the Security account's destination.Cevap
- BInstall the unified CloudWatch agent on the EC2 instances. In the agent configuration file, set the log path to `/var/log/api/server.log`. Configure the agent to publish logs to a local CloudWatch Logs log group. In the Security account, create a centralized Kinesis Data Firehose delivery stream that writes to the S3 bucket, encrypted with the default AWS-managed S3 key (`aws/s3`). Set up a CloudWatch Logs destination in the Security account, and create a cross-account subscription filter in the member accounts.
- CInstall the unified CloudWatch agent on the EC2 instances. In the agent configuration file, use the wildcard path `/var/log/api/server.log*`. Configure the agent to push logs directly to a cross-account S3 bucket in the Security account. In the Security account, configure an S3 bucket policy that allows `s3:PutObject` permissions for the AWS Organization ID, but omit the configuration of a CloudWatch Logs log group or Firehose delivery stream.
- DInstall the unified CloudWatch agent on the EC2 instances. In the agent configuration file, use the wildcard path `/var/log/api/server.log*`. Configure the agent to publish logs to a local CloudWatch Logs log group. Create a cross-account IAM role in the member accounts that grants Kinesis Data Firehose write access, and configure the local CloudWatch Logs subscription filters to stream logs directly to the Firehose delivery stream in the Security account without creating a CloudWatch Logs destination.
Cevap
Install the unified CloudWatch agent on the EC2 instances, configuring the log path to `/var/log/api/server.log*` to match rotated logs. Stream the logs to a local CloudWatch Logs log group, and configure cross-account subscription filters targeting a CloudWatch Logs destination in the Security account. The destination will stream the logs to a Kinesis Data Firehose delivery stream writing to the destination S3 bucket encrypted with a Customer Managed Key (CMK).
The correct solution uses the wildcard path (`/var/log/api/server.log*`) in the unified CloudWatch agent configuration, which matches rotated files and prevents log loss. To achieve cross-account streaming, it uses CloudWatch Logs destinations in the Security account to receive logs from subscription filters in the member accounts, and routes them to a Kinesis Data Firehose stream. Using a Customer Managed Key (CMK) allows configuring key policy permissions for cross-account access.
Adım Adım Çözüm
Anahtar Kavram
Centralized cross-account logging with dynamic log path wildcard ingestion and cross-account access controls.
Tahmini Süre:3m 0s