DOP-C02 Question 232
Select 2Your organization is implementing centralized log collection using Amazon CloudWatch Logs. You need to configure an EC2 instance to push application logs to a specific CloudWatch Logs log group. Which of the following IAM configurations will allow the EC2 instance to securely send logs to CloudWatch Logs while adhering to the principle of least privilege?
- A
Attach an IAM role to the EC2 instance with the 'CloudWatchLogsFullAccess' managed policy.
- B
Attach an IAM role to the EC2 instance with a custom policy granting 'logs:PutLogEvents', 'logs:CreateLogGroup', and 'logs:CreateLogStream' permissions for the specific log group.
- C
Create an IAM user with the 'CloudWatchLogsFullAccess' managed policy and use its credentials in the EC2 instance.
- D
Attach an IAM role to the EC2 instance with a custom policy granting 'logs:PutLogEvents' permission for all log groups across the account.
- E
Attach an IAM role to the EC2 instance with a custom policy granting 'logs:PutLogEvents', 'logs:DescribeLogStreams', and 'logs:CreateLogStream' permissions for the specific log group.
Show answer and explanation
Correct answers: B, E
Explanation
To securely send logs from an EC2 instance to Amazon CloudWatch Logs, an IAM role should be attached to the EC2 instance with permissions that adhere to the principle of least privilege. Options 2 and 5 correctly define custom policies with the minimum necessary permissions for the specific log group. Using managed policies like 'CloudWatchLogsFullAccess' grants excessive privileges, and using IAM users is not a recommended approach for EC2 instances.
- A. Incorrect.
This option grants excessive permissions by using the 'CloudWatchLogsFullAccess' managed policy, which violates the principle of least privilege.
- B. Correct.
This option adheres to the principle of least privilege by defining a custom policy with specific permissions ('logs:PutLogEvents', 'logs:CreateLogGroup', and 'logs:CreateLogStream') for the required log group.
- C. Incorrect.
This option involves using an IAM user and its credentials, which is not a best practice for EC2 instances. IAM roles should be used instead.
- D. Incorrect.
This option grants excessive permissions ('logs:PutLogEvents' for all log groups) and does not adhere to the principle of least privilege.
- E. Correct.
This option adheres to the principle of least privilege by defining a custom policy with specific permissions ('logs:PutLogEvents', 'logs:DescribeLogStreams', and 'logs:CreateLogStream') for the required log group.