ANS-C01 Question 126
Select 2Your organization is using an Application Load Balancer (ALB) to manage incoming traffic for a web application. To comply with corporate governance policies, you need to enable access logging for the ALB to monitor client requests and ensure the logs are stored securely. Which of the following steps should you take to set up access logging for the ALB?
- A
Ensure the ALB has an IAM role with permissions to write to an S3 bucket.
- B
Enable access logging on the ALB and specify an S3 bucket as the target for the logs.
- C
Configure a CloudWatch Logs group to receive log data from the ALB.
- D
Ensure the S3 bucket policy allows the ALB to write logs to it.
- E
Use the AWS CLI to enable logging for the ALB, as this cannot be done through the console.
Show answer and explanation
Correct answers: B, D
Explanation
To enable access logging for an Application Load Balancer, you need to enable the logging feature and specify an S3 bucket as the destination for the logs. Additionally, the S3 bucket must have an appropriate bucket policy that allows the ALB to write logs to it. No IAM role is required for this process, and access logs are not sent to CloudWatch Logs.
- A. Incorrect.
Incorrect. Application Load Balancers do not require an IAM role for logging. Instead, they write logs directly to an S3 bucket specified during configuration.
- B. Correct.
Correct. You must enable access logging on the ALB and specify an S3 bucket where the logs will be stored.
- C. Incorrect.
Incorrect. ALB access logs are stored in S3, not CloudWatch Logs. CloudWatch Logs are used for other types of logging, such as application logs.
- D. Correct.
Correct. The S3 bucket policy must explicitly allow the ALB to write logs to it. Without proper permissions, access logging will fail.
- E. Incorrect.
Incorrect. Access logging for an ALB can be enabled through both the AWS Management Console and the AWS CLI. It is not restricted to the CLI.