A SysOps Administrator is monitoring an application log group in Amazon CloudWatch Logs. The administrator has created a metric filter to match the term 'AccessDenied' and configured it to increment a custom metric named 'AccessDeniedCount'. The administrator now needs to ensure that the security team receives an email notification whenever this error occurs.
What is the next step the administrator must take to send an email notification when the error occurs?
- Create a CloudWatch alarm based on the custom metric 'AccessDeniedCount' and configure it to send a notification to an Amazon SNS topic subscribed to the security team's email.Cevap
- BEnable Detailed Monitoring on the log group to trigger an email alert through the standard CloudWatch logging daemon.
- CConfigure a log retention policy on the log group to forward matching events directly to the security team's email address.
- DCreate an Amazon EventBridge rule that monitors the log group directly and uses a Systems Manager Automation runbook to email the team.
Cevap
Create a CloudWatch alarm based on the custom metric 'AccessDeniedCount' and configure it to send a notification to an Amazon SNS topic subscribed to the security team's email.
To send alerts based on log events, you must follow the CloudWatch log monitoring pattern: Metric Filter -> Custom Metric -> CloudWatch Alarm -> SNS Topic. The correct answer successfully describes this chain by configuring the alarm on the custom metric to notify an SNS topic that has the security team's email as a subscriber.
Adım Adım Çözüm
Anahtar Kavram
Integrating CloudWatch metric filters with alarms and SNS notifications for alerting
Tahmini Süre:1m 0s