Examkin

Soru

Zorluk: OrtaTroubleshooting Monitoring, Logging, and Permissions

A SysOps administrator is attempting to export historical log data from an Amazon CloudWatch Logs log group in the us-east-1 Region to an Amazon S3 bucket for long-term archiving. The administrator has verified that their IAM identity has the `logs:CreateExportTask` permission. However, when initiating the export task, it immediately fails with the following error:

`An error occurred (InvalidParameterException) when calling the CreateExportTask operation: The S3 bucket owner does not have write permission on the bucket.`

Which of the following actions will resolve this issue?

  1. Add a bucket policy to the destination Amazon S3 bucket that allows the logs.us-east-1.amazonaws.com service principal to perform the s3:PutObject and s3:GetBucketAcl actions.Cevap
  2. B
    Create an IAM role with S3 write permissions, and assign the iam:PassRole permission to the SysOps administrator to pass this role to the CloudWatch Logs service during the export task.
  3. C
    Update the bucket policy of the destination Amazon S3 bucket to allow the cloudtrail.amazonaws.com service principal to write to the bucket.
  4. D
    Modify the log retention settings of the CloudWatch log group to allow unlimited retention, as log groups with active expiration periods cannot be exported.

Cevap

Add a bucket policy to the destination Amazon S3 bucket that allows the logs.us-east-1.amazonaws.com service principal to perform the s3:PutObject and s3:GetBucketAcl actions.
The correct action is to add a bucket policy to the destination Amazon S3 bucket that allows the logs.us-east-1.amazonaws.com service principal to perform the s3:PutObject and s3:GetBucketAcl actions. CloudWatch Logs requires these resource-based permissions on the target S3 bucket to verify ownership and write the exported log data.

Adım Adım Çözüm

1
Identify the service principal responsible for performing the log export operation.
The CloudWatch Logs service principal (logs.us-east-1.amazonaws.com for the us-east-1 Region) is identified as the entity performing the write.
AWS services that write data directly to customer-owned resources must be authorized using resource-based policies.
2
Determine the necessary S3 permissions required by the CloudWatch Logs service.
The service requires s3:PutObject to write the log objects and s3:GetBucketAcl to verify ownership of the bucket.
CloudWatch Logs checks the bucket ACL before writing to ensure that the account owner owns the destination bucket.
3
Configure and apply the S3 bucket policy containing these permissions and condition keys for security best practices.
The bucket policy is updated to allow logs.us-east-1.amazonaws.com to write to the bucket, optionally restricted by aws:SourceAccount and aws:SourceArn.
This grants the CloudWatch Logs service the necessary write access to resolve the InvalidParameterException error.

Anahtar Kavram

CloudWatch Logs to Amazon S3 Export Permissions
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Troubleshooting Monitoring, Logging, and Permissions

Bu konudan daha fazla soru