SCS-C02 · Question #151
An Amazon EC2 Auto Scaling group launches Amazon Linux EC2 instances and installs the Amazon CloudWatch agent to publish logs to Amazon CloudWatch Logs. The EC2 instances launch with an IAM role…
The correct answer is A. Configure the IAM policy in use by the IAM role to have access to the required cloudwatch: API. The problem is with the ec2 instance not being able to publish logs from the cloudwatch agent running on the instance and not really to do with the autoscaling service role. The auto scaling service role will instead require the following: Create, describe, modify, and delete…
Question
An Amazon EC2 Auto Scaling group launches Amazon Linux EC2 instances and installs the Amazon CloudWatch agent to publish logs to Amazon CloudWatch Logs. The EC2 instances launch with an IAM role that has an IAM policy attached. The policy provides access to publish custom metrics to CloudWatch. The EC2 instances run in a private subnet inside a VPC The VPC provides access to the internet for private subnets through a NAT gateway. A security engineer notices that no logs are being published to CloudWatch Logs for the EC2 instances that the Auto Scaling group launches. The security engineer validates that the CloudWatch Logs agent is running and is configured properly on the EC2 instances. In addition, the security engineer validates that network communications are working properly to AWS services. What can the security engineer do to ensure that the logs are published to CloudWatch Logs?
Options
- AConfigure the IAM policy in use by the IAM role to have access to the required cloudwatch: API
- BAdjust the Amazon EC2 Auto Scaling service-linked role to have permissions to write to
- CConfigure the IAM policy in use by the IAM role to have access to the required AWS logs: API
- DAdd an interface VPC endpoint to provide a route to CloudWatch Logs.
How the community answered
(42 responses)- A79% (33)
- B12% (5)
- C2% (1)
- D7% (3)
Explanation
The problem is with the ec2 instance not being able to publish logs from the cloudwatch agent running on the instance and not really to do with the autoscaling service role. The auto scaling service role will instead require the following: Create, describe, modify, and delete CloudWatch alarms for scaling policies and retrieve metrics used for predictive scaling. https://docs.aws.amazon.com/autoscaling/ec2/userguide/autoscaling-service-linked- role.html#service-linked-role-permissions
Topics
Community Discussion
No community discussion yet for this question.