Examkin

Soru

Zorluk: OrtaVPC Flow Logs and Network Monitoring

A SysOps Administrator is using the AWS CLI to configure VPC Flow Logs to monitor rejected network traffic at the subnet level. The administrator wants to deliver the flow logs to an Amazon CloudWatch Logs log group. To comply with company security policies, the administrator must ensure that the role used to deliver the logs operates with least privilege. Additionally, to manage costs, the logs must be retained for only 90 days.

Which TWO actions must the administrator take to complete this configuration and meet these requirements?

  1. Create an IAM role with a trust policy that allows the vpc-flow-logs.amazonaws.com service principal to assume it, and attach a policy granting logs:CreateLogStream and logs:PutLogEvents permissions for the destination log group.Cevap
  2. Modify the retention settings of the destination CloudWatch Logs log group to expire log events after 90 days.Cevap
  3. C
    Grant the administrator's IAM user the sts:AssumeRole permission on the flow logs delivery role rather than the iam:PassRole permission when creating the flow log.
  4. D
    Leave the CloudWatch Logs log group retention period at its default setting, relying on the native flow log delivery configuration to manage object lifecycles.
  5. E
    Configure an Amazon EventBridge rule that triggers an AWS Systems Manager Automation document to delete log streams older than 90 days from the log group.

Cevap

Create an IAM role with a trust policy that allows the vpc-flow-logs.amazonaws.com service principal to assume it, and attach a policy granting logs:CreateLogStream and logs:PutLogEvents permissions for the destination log group; and modify the retention settings of the destination CloudWatch Logs log group to expire log events after 90 days.
To configure VPC Flow Logs to deliver to CloudWatch Logs, the service requires an IAM role with a trust policy allowing vpc-flow-logs.amazonaws.com to assume it, along with a permissions policy to write to the destination log group. In addition, CloudWatch Logs log groups have a default retention of 'Never expire', so the retention period must be explicitly updated to 90 days to meet the storage requirements and manage costs.

Adım Adım Çözüm

1
Configure the IAM delivery role for VPC Flow Logs.
An IAM role with the correct trust relationship (vpc-flow-logs.amazonaws.com) and policy permissions (logs:CreateLogStream, logs:PutLogEvents) is created, allowing VPC Flow Logs to write to CloudWatch.
This establishes the necessary trust and access permissions for the flow logs service to deliver network telemetry data to the destination log group.
2
Set the log retention policy in CloudWatch Logs.
The destination log group's retention configuration is updated from 'Never expire' to 90 days.
This limits log storage to the required 90-day window, preventing unnecessary storage costs.

Anahtar Kavram

VPC Flow Logs require an IAM role to publish to CloudWatch Logs, and CloudWatch Logs retention must be configured to manage log expiration.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

VPC Flow Logs and Network Monitoring

Bu konudan daha fazla soru