Examkin

Soru

Zorluk: KolayTroubleshooting Monitoring, Logging, and Permissions

An administrator has installed the unified Amazon CloudWatch agent on an Amazon EC2 instance to send application log files to Amazon CloudWatch Logs. The agent status is running, but no log streams are appearing in the CloudWatch console. Which of the following configurations is missing and preventing the logs from being delivered?

  1. A
    The IAM policy for the administrator role lacks the iam:PassRole permission needed to assign the role to the CloudWatch agent.
  2. B
    The target CloudWatch log group has a retention policy configured to zero days, which automatically deletes log streams as soon as they are received.
  3. C
    The S3 bucket policy for the log group's storage location is missing permission to allow write access from the EC2 instance.
  4. The IAM role associated with the EC2 instance profile does not have the policy permissions required to create log streams and put log events in CloudWatch Logs.Cevap

Cevap

The IAM role associated with the EC2 instance profile does not have the policy permissions required to create log streams and put log events in CloudWatch Logs.
For the unified CloudWatch agent on an EC2 instance to send logs to CloudWatch Logs, it must run with the proper IAM permissions. Since the agent executes on the EC2 instance, it uses the credentials provided by the EC2 instance profile's IAM role. If this role is missing the permissions for logs:CreateLogStream and logs:PutLogEvents (commonly provided by the CloudWatchAgentServerPolicy managed policy), the logs cannot be sent.

Adım Adım Çözüm

1
Verify that the Amazon CloudWatch agent is running and configured correctly on the EC2 instance.
The agent status is active and logs are processed locally, but fail to appear in CloudWatch.
This isolates the issue to permissions or network connectivity rather than agent configuration.
2
Check the IAM role attached to the EC2 instance profile and inspect its permissions policy.
The IAM role is missing permissions such as logs:CreateLogStream and logs:PutLogEvents.
The EC2 instance needs explicit AWS API permissions to publish logs to CloudWatch Logs.
3
Attach the AWS managed policy CloudWatchAgentServerPolicy to the IAM role.
The EC2 instance now has permissions to push metrics and logs to CloudWatch.
This updates the IAM credentials used by the agent to allow successful log transmission.

Anahtar Kavram

EC2 Instance Profile and CloudWatch Logs Permissions
Bu soruyu puanla

Konular

Troubleshooting Monitoring, Logging, and Permissions

Bu konudan daha fazla soru