Examkin

Soru

Zorluk: ZorTroubleshooting Monitoring, Logging, and Permissions

A SysOps administrator in a production AWS account (Account A: `111122223333`) is configuring cross-account logging. The administrator wants to stream application logs from a CloudWatch log group named `AppLogs` in Account A to a centralized CloudWatch Logs destination named `CentralLogDestination` in a security account (Account B: `444455556666`).

The administrator runs the following AWS CLI command in Account A:

bash
aws logs put-subscription-filter \
--log-group-name "AppLogs" \
--filter-name "CentralFilter" \
--filter-pattern "" \
--destination-arn "arn:aws:logs:us-east-1:444455556666:destination:CentralLogDestination"

The command fails with the following error:

`An error occurred (AccessDeniedException) when calling the PutSubscriptionFilter operation.`

Which configuration issue is the root cause of this failure?

  1. The access policy of the destination CentralLogDestination in Account B does not grant the logs:PutSubscriptionFilter permission to Account A (111122223333).Cevap
  2. B
    The IAM user executing the command in Account A lacks the iam:PassRole permission to pass the target IAM role to the log group.
  3. C
    The IAM role associated with CentralLogDestination in Account B has an incorrect trust policy that does not allow the logs.amazonaws.com service principal to assume it.
  4. D
    The KMS key policy used to encrypt the Kinesis Data Stream destination in Account B does not grant decrypt permissions to the AWS CLI user in Account A.

Cevap

The access policy of the destination CentralLogDestination in Account B does not grant the logs:PutSubscriptionFilter permission to Account A (111122223333).
The correct answer is that the destination's access policy in the target account must grant logs:PutSubscriptionFilter permission to the source account. When creating a cross-account log subscription filter, CloudWatch Logs validates that the destination allows the source account to perform this action. If the destination's access policy is missing or misconfigured, the API call fails immediately with an AccessDeniedException.

Adım Adım Çözüm

1
Understand the API flow of a cross-account CloudWatch Logs subscription filter setup.
Creating a subscription filter in a source account targeting a destination in another account requires authorization at the target resource level.
This helps identify where permissions are checked during the PutSubscriptionFilter API call.
2
Check the role of the destination access policy.
The destination resource (AWS::Logs::Destination) controls access via a resource-based policy that must explicitly list the source account ID and the logs:PutSubscriptionFilter action.
If this policy is missing or does not grant access to the source account, the PutSubscriptionFilter API call will immediately return an AccessDeniedException.
3
Differentiate between API call authorization and log delivery execution permissions.
The destination's execution role trust policy (trusting logs.amazonaws.com) is evaluated when log events are actually being delivered, not when the filter is registered.
This eliminates the role's trust policy as the cause of the immediate PutSubscriptionFilter AccessDeniedException.

Anahtar Kavram

Cross-account log subscription filter permissions rely on resource-based policies attached to the CloudWatch Logs Destination.
Tahmini Süre:2m 30s
Bu soruyu puanla

Konular

Troubleshooting Monitoring, Logging, and Permissions

Bu konudan daha fazla soru