A company recently created a test AWS account to use for a development environment. The company also created a production AWS account in another AWS Region. As part of its security testing the…

Question

Options

• ACreate a subscription filter in the production accounts CloudWatch Logs to target the Kinesis data
• BIn the test account create an IAM role that grants access to the Kinesis data stream and the
• CIn the test account, create an IAM role that grants access to the Kinesis data stream and the
• DCreate a destination data stream in Kinesis Data Streams in the test account with an IAM role and

• A
  10% (3)
• B
  3% (1)
• C
  3% (1)
• D
  84% (26)

Explanation

Cross-account CloudWatch Logs subscription to Kinesis Data Streams requires a specific setup on the destination (test) account side. The correct approach is: (1) Create a Kinesis Data Stream in the test account, (2) Create a CloudWatch Logs destination that points to that stream along with an IAM role giving CloudWatch Logs permission to put records into the stream, and (3) Set a destination access policy that allows the production account's CloudWatch Logs to write to this destination. Once the destination is set up in the test account, you then create a subscription filter in the production account's CloudWatch Logs group targeting the destination ARN in the test account. This is AWS's standard cross-account log streaming architecture. Options A, B, and C are incomplete because they describe only partial steps without the full destination configuration required for cross-account delivery.

No community discussion yet for this question.