nerdexam
Amazon

SCS-C02 · Question #85

A security engineer logs in to the AWS Lambda console with administrator permissions. The security engineer is trying to view logs in Amazon CloudWatch for a Lambda function that is named…

The correct answer is D. Add the logs:CreateLogStream action to the second Allow statement. https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/iam-identity-based-access-control-

Submitted by the_admin· Mar 6, 2026Identity and Access Management

Question

A security engineer logs in to the AWS Lambda console with administrator permissions. The security engineer is trying to view logs in Amazon CloudWatch for a Lambda function that is named myFunction. When the security engineer chooses the option in the Lambda console to view logs in CloudWatch, an "error loading Log Streams" message appears. The IAM policy for the Lambda function's execution role contains the following:

How should the security engineer correct the error?

Options

  • AMove the logs:CreateLogGroup action to the second Allow statement.
  • BAdd the logs:PutDestination action to the second Allow statement.
  • CAdd the logs:GetLogEvents action to the second Allow statement.
  • DAdd the logs:CreateLogStream action to the second Allow statement.

How the community answered

(32 responses)
  • A
    3% (1)
  • B
    3% (1)
  • C
    9% (3)
  • D
    84% (27)

Explanation

https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/iam-identity-based-access-control-

Topics

#Lambda execution role#CloudWatch Logs permissions#IAM policy#CreateLogStream

Community Discussion

No community discussion yet for this question.

Full SCS-C02 Practice