An application running on an Amazon EC2 instance in a private subnet is unable to connect to an external database. To determine if outbound network connection attempts are being blocked, a SysOps Administrator decides to enable VPC Flow Logs for the subnet and publish the logs to a new Amazon CloudWatch Logs group.
Which of the following actions must the administrator perform to implement this configuration? (Select TWO.)
- Create an IAM role with a trust policy that allows the vpc-flow-logs.amazonaws.com service principal to assume the role.Cevap
- Set the traffic filter setting on the flow log to REJECT.Cevap
- CAssociate an IAM policy with the CloudWatch Logs group that grants iam:PassRole permissions to the SysOps Administrator.
- DConfigure a log retention policy of zero days on the destination CloudWatch Logs group to enable real-time log delivery.
- ECreate an Amazon EventBridge rule that detects subnet traffic activity and routes it to the CloudWatch Logs group.
Cevap
Create an IAM role with a trust policy that allows the VPC Flow Logs service principal to assume the role, and set the traffic filter on the flow log to REJECT.
The correct actions are to create an IAM role that trusts the VPC Flow Logs service principal to assume the role, and to set the flow log filter to REJECT. To publish flow logs to Amazon CloudWatch Logs, the VPC Flow Logs service requires permissions to create log streams and publish log events to the target log group, which is achieved by assuming a configured IAM role. Furthermore, because the administrator is specifically troubleshooting blocked outbound connection attempts, setting the filter to REJECT isolates the relevant traffic records.
Adım Adım Çözüm
Anahtar Kavram
VPC Flow Logs destination delivery to CloudWatch Logs requires a service trust relationship (AssumeRole) to write logs, and filtering can be customized to capture only accepted, rejected, or all traffic.