A company has a web application that is hosted on an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The EKS cluster runs on AWS Fargate that is available through an internet-facing…

Question

Options

• ADeploy the CloudWatch agent as a Kubernetes StatefulSet to the EKS cluster.
• BDeploy the AWS Distro for OpenTelemetry Collector as a Kubernetes DaemonSet to the EKS
• CAssociate a Kubernetes service account with an IAM role by using IAM roles for service accounts
• DAssociate a Kubernetes service account with an IAM role by using IAM roles for service accounts
• EConfigure an IAM OpenID Connect (OIDC) provider for the EKS cluster.
• FEnable EKS control plane logging for the EKS cluster.

• A
  14% (6)
• B
  55% (23)
• D
  5% (2)
• F
  26% (11)

Explanation

The AWS Distro for OpenTelemetry (ADOT) Collector is designed for observability and integrates well with CloudWatch, allowing you to collect metrics, traces, and logs from applications. Using a DaemonSet ensures that the Collector is running on every Fargate node in your EKS cluster, which is crucial for application monitoring. IAM roles for service accounts (IRSA) allow you to assign an IAM role to a Kubernetes service account. Using the CloudWatchAgentServerPolicy provides the necessary permissions for the CloudWatch agent to write data to CloudWatch without granting overly broad permissions. OIDC is required for IAM roles for service accounts (IRSA) to work. This allows EKS to authenticate and authorize requests from the service account to assume the IAM role that gives access to CloudWatch.

No community discussion yet for this question.