Examkin

Soru

Zorluk: OrtaTroubleshooting Monitoring, Logging, and Permissions

A SysOps administrator has configured Amazon VPC Flow Logs for a production VPC to publish flow logs to an Amazon CloudWatch Logs log group. Although the VPC is actively routing network traffic, no log streams are being created in the destination log group after several hours. The flow logs resource status in the VPC dashboard shows that the configuration is active.

Which of the following is the most likely cause of this issue?

  1. The IAM role associated with the VPC Flow Logs configuration lacks a trust policy that allows the vpc-flow-logs.amazonaws.com service principal to assume the role.Cevap
  2. B
    The administrator's IAM policy lacks the iam:PassRole permission, which prevents the VPC Flow Logs configuration from successfully delivering the logs.
  3. C
    The destination CloudWatch Logs log group has its log retention policy configured to "Never Expire," which prevents the initialization of new log streams.
  4. D
    The EC2 instances inside the VPC are only configured for Standard Monitoring, which does not produce the detailed metric logs required by the VPC Flow Logs service.

Cevap

The IAM role associated with the VPC Flow Logs configuration lacks a trust policy that allows the vpc-flow-logs.amazonaws.com service principal to assume the role.
The correct answer is that the IAM role associated with the VPC Flow Logs configuration lacks a trust policy that allows the vpc-flow-logs.amazonaws.com service principal to assume the role. For VPC Flow Logs to deliver logs to CloudWatch Logs, the VPC service must assume the specified IAM role. Without a trust relationship that explicitly permits vpc-flow-logs.amazonaws.com to execute the sts:AssumeRole action, the service cannot retrieve temporary security credentials to write log data, causing the delivery to fail silently.

Adım Adım Çözüm

1
Differentiate between configuration-time errors and runtime errors in AWS resource delivery.
Since the VPC Flow Logs resource status shows as successfully active but no log streams are created in CloudWatch Logs, the error occurs at runtime during log delivery, not during the initial configuration.
This rules out configuration-time IAM checks like iam:PassRole, which would have prevented the creation of the resource entirely.
2
Examine the runtime permissions required by the VPC Flow Logs service to publish to CloudWatch Logs.
The VPC Flow Logs service needs to assume the specified IAM role to gain authorization to write to the CloudWatch log group.
If the trust policy of the IAM role does not list 'vpc-flow-logs.amazonaws.com' as a trusted entity with the 'sts:AssumeRole' action, the assume-role request fails, and the service cannot deliver logs.
3
Verify that other monitoring and log group configurations are not blocking delivery.
Confirm that CloudWatch Logs retention policies and EC2 instance monitoring levels (Standard vs. Detailed) do not restrict log ingestion.
Retention settings only control the lifespan of stored logs, and instance-level CloudWatch monitoring does not affect VPC network flow capture.

Anahtar Kavram

VPC Flow Logs runtime service permissions and IAM role trust relationships
Bu soruyu puanla

Konular

Troubleshooting Monitoring, Logging, and Permissions

Bu konudan daha fazla soru