A company's SysOps administrator is troubleshooting communication between the components of an application. The company configured VPC flow logs to be published to Amazon CloudWatch Logs. However…

Question

Options

• AThe IAM policy that is attached to the IAM role for the flow log is missing the logs
• BThe IAM policy that is attached to the IAM role for the flow log is missing the logs
• CThe VPC is configured for IPv6 addresses
• DThe VPC is peered with another VPC in the AWS account

• A
  83% (29)
• B
  6% (2)
• C
  9% (3)
• D
  3% (1)

Explanation

Option A is correct because VPC flow logs require an IAM role with a policy that grants specific CloudWatch Logs permissions - specifically logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents - and without these, the flow log service cannot write records to CloudWatch Logs at all. Option B appears to be a duplicate of A (likely a formatting artifact in this question), so it does not represent a distinct distractor. Option C is wrong because VPC flow logs support both IPv4 and IPv6 traffic natively; using IPv6 does not prevent log delivery. Option D is wrong because VPC peering has no effect on flow log publishing - each VPC's flow logs are published independently to their configured destination.

Memory tip: Think "flow logs need to flow somewhere" - the IAM role is the pipe, and if the pipe lacks CreateLogGroup, CreateLogStream, and PutLogEvents permissions, nothing can get through to CloudWatch. Permissions issues are almost always the first thing to check when an AWS service "can see the destination but can't write to it."

No community discussion yet for this question.