Examkin

Soru

Zorluk: OrtaTroubleshooting Monitoring, Logging, and Permissions

A SysOps administrator has configured an Amazon CloudWatch alarm to monitor the CPU utilization of an Auto Scaling group. The alarm is configured to send notifications to an Amazon SNS topic when the CPU utilization exceeds 80%80\%. The SNS topic is encrypted using a customer managed AWS KMS key. During a load test, the CPU utilization exceeded the threshold, and the alarm state changed to ALARM, but no notifications were sent.

Which TWO actions should the administrator take to resolve this issue? (Select TWO.)

  1. Modify the AWS KMS key policy to grant the Amazon CloudWatch service principal (cloudwatch.amazonaws.com) permissions to execute the kms:Decrypt and kms:GenerateDataKey actions.Cevap
  2. Modify the Amazon SNS topic access policy to grant the Amazon CloudWatch service principal (cloudwatch.amazonaws.com) permissions to execute the sns:Publish action.Cevap
  3. C
    Enable CloudWatch Detailed Monitoring on the Amazon EC2 instances to reduce the metric granularity from 55 minutes to 11 minute.
  4. D
    Create a custom IAM role with iam:PassRole permissions and attach it to the CloudWatch alarm to authorize it to assume the execution role.
  5. E
    Create an Amazon EventBridge rule that triggers a Systems Manager Automation runbook to publish messages to the SNS topic when the CloudWatch alarm enters the ALARM state.

Cevap

The administrator must modify the AWS KMS key policy to allow the CloudWatch service principal to perform the kms:Decrypt and kms:GenerateDataKey actions, and modify the Amazon SNS topic access policy to allow the CloudWatch service principal to perform the sns:Publish action.
To resolve the notification failure, the CloudWatch service principal must be granted explicit permissions on both the target resource and its encryption key. The configuration requires modifying the KMS key policy to permit the CloudWatch service principal (`cloudwatch.amazonaws.com`) to execute both `kms:Decrypt` and `kms:GenerateDataKey`. Additionally, the SNS topic access policy must grant `sns:Publish` access to `cloudwatch.amazonaws.com` so CloudWatch can deliver the alert messages.

Adım Adım Çözüm

1
Analyze the event flow and identify the failure point.
The CloudWatch alarm successfully changes state to ALARM, but the notification action fails because the target SNS topic is encrypted with a customer managed KMS key.
Since the alarm transitions but no message is sent, the issue lies in the authorization pathway between CloudWatch, SNS, and KMS.
2
Update the SNS topic access policy.
The CloudWatch service principal is granted sns:Publish permissions directly on the SNS topic.
By default, SNS topics do not allow external service principals like CloudWatch to publish messages unless explicitly defined in the access policy.
3
Update the customer managed KMS key policy.
The CloudWatch service principal is granted kms:Decrypt and kms:GenerateDataKey permissions on the KMS key used by the SNS topic.
When SNS topic encryption is enabled with a customer managed key, the publishing service (CloudWatch) must be allowed to use that key to encrypt the payload before delivery.

Anahtar Kavram

Permissions required for Amazon CloudWatch to publish to encrypted Amazon SNS topics
Bu soruyu puanla

Konular

Troubleshooting Monitoring, Logging, and Permissions

Bu konudan daha fazla soru