DOP-C02 Question 231
Single answerYour organization is setting up centralized logging using Amazon CloudWatch Logs to collect application logs from multiple Amazon EC2 instances. You need to ensure that the EC2 instances can send logs to CloudWatch Logs while adhering to the principle of least privilege. What is the best way to configure the required permissions?
- A
Attach the AmazonCloudWatchLogsFullAccess policy directly to each EC2 instance.
- B
Create an IAM role with the AmazonCloudWatchLogsFullAccess policy and associate the role with the EC2 instances.
- C
Create an IAM role with a custom policy granting only the PutLogEvents and CreateLogStream actions for CloudWatch Logs, and associate the role with the EC2 instances.
- D
Manually create an IAM user with programmatic access, assign it the AmazonCloudWatchLogsFullAccess policy, and configure the EC2 instances with the user's credentials.
Show answer and explanation
Correct answer: C
Explanation
The best approach to grant EC2 instances permission to send logs to CloudWatch Logs is to create an IAM role with a custom policy that grants only the necessary permissions (e.g., PutLogEvents and CreateLogStream) and associate the role with the EC2 instances. This method adheres to the principle of least privilege and avoids granting unnecessary permissions or introducing security risks through hardcoded credentials.
- A. Incorrect.
Attaching the AmazonCloudWatchLogsFullAccess policy directly to the EC2 instances is not possible because IAM policies cannot be directly attached to EC2 instances. Permissions must be assigned via an IAM role.
- B. Incorrect.
While associating an IAM role with the AmazonCloudWatchLogsFullAccess policy to the EC2 instances works, this policy grants excessive permissions beyond what is required for log collection, violating the principle of least privilege.
- C. Correct.
Creating an IAM role with a custom policy granting only the PutLogEvents and CreateLogStream actions for CloudWatch Logs, and associating the role with the EC2 instances, adheres to the principle of least privilege while fulfilling the log collection requirement.
- D. Incorrect.
Manually creating an IAM user and assigning it the AmazonCloudWatchLogsFullAccess policy is not a recommended practice. It introduces security risks, such as hardcoding credentials in the EC2 instances, and violates AWS best practices.