DVA-C02 · Question #782
A company's application runs on a fleet of Amazon EC2 instances in a VPC within private subnets that do not have public internet access. The company uses Amazon CloudWatch to monitor the…
The correct answer is C. Attach the CloudWatchAgentServerPolicy managed IAM policy to the IAM role that is associated. In private subnets without internet access, the CloudWatch agent needs private connectivity to CloudWatch to publish metrics, which is provided by a VPC interface endpoint. The EC2 instance profile also needs permissions to publish metrics and logs, which are granted by the…
Question
A company's application runs on a fleet of Amazon EC2 instances in a VPC within private subnets that do not have public internet access. The company uses Amazon CloudWatch to monitor the application. A developer is troubleshooting an issue with the application. Some performance metrics are not being published to CloudWatch. The developer uses EC2 Instance Connect to access an EC2 instance. The developer verifies that a CloudWatch agent is pre-installed and running. The developer needs to ensure that the performance metrics are published to CloudWatch. Which solution will meet this requirement in the MOST secure way?
Options
- AAttach the CloudWatchAgentAdminPolicy managed IAM policy to the IAM role that is associated
- BAdd a user data script to install and start up the CloudWatch agent automatically when the EC2
- CAttach the CloudWatchAgentServerPolicy managed IAM policy to the IAM role that is associated
- DAttach the CloudWatchReadOnlyAccess managed IAM policy to the IAM role that is associated
How the community answered
(31 responses)- A6% (2)
- B3% (1)
- C77% (24)
- D13% (4)
Explanation
In private subnets without internet access, the CloudWatch agent needs private connectivity to CloudWatch to publish metrics, which is provided by a VPC interface endpoint. The EC2 instance profile also needs permissions to publish metrics and logs, which are granted by the CloudWatchAgentServerPolicy managed policy. This combination enables metric delivery without exposing instances to the public internet and follows least-privilege more closely than administrative permissions.
Community Discussion
No community discussion yet for this question.