DOP-C02 Question 233
Select 2You are setting up centralized log collection for all applications in your organization using Amazon CloudWatch Logs. To ensure proper security and functionality, you need to configure IAM roles and permissions. Which of the following actions should you take to allow EC2 instances to send application logs to CloudWatch Logs?
- A
Attach an IAM role to the EC2 instances with a policy that includes 'logs:PutLogEvents' and 'logs:CreateLogStream' actions.
- B
Create a policy that grants 'logs:DescribeLogGroups' and attach it directly to the CloudWatch Logs service.
- C
Ensure the IAM role attached to the EC2 instances has a trust relationship allowing CloudWatch Logs to assume the role.
- D
Specify the required permissions in a custom policy and attach the policy to the EC2 instance profile.
- E
Use the CloudWatch Agent to push logs from EC2 instances and configure it to use an IAM role with the appropriate permissions.
Show answer and explanation
Correct answers: A, E
Explanation
To securely and effectively enable EC2 instances to send logs to CloudWatch Logs, you need to attach an IAM role with appropriate permissions ('logs:PutLogEvents' and 'logs:CreateLogStream') to the instances. Using the CloudWatch Agent is a best practice for log collection, as it simplifies the process and ensures compatibility with CloudWatch Logs. Other actions, such as setting up trust relationships or attaching insufficient permissions, are either unnecessary or incomplete.
- A. Correct.
Correct. 'logs:PutLogEvents' and 'logs:CreateLogStream' are required actions for EC2 instances to publish logs to CloudWatch Logs. The IAM role attached to EC2 instances must have these permissions.
- B. Incorrect.
Incorrect. 'logs:DescribeLogGroups' is not sufficient for EC2 instances to send logs. Additionally, attaching policies directly to AWS services is not a valid approach.
- C. Incorrect.
Incorrect. An IAM role attached to EC2 instances does not require a trust relationship with CloudWatch Logs. Instead, it needs permissions to interact with CloudWatch Logs.
- D. Incorrect.
Incorrect. While specifying permissions in a custom policy is valid, attaching the policy to the EC2 instance profile does not fully implement the solution. Other steps, such as using a logging agent, are necessary.
- E. Correct.
Correct. The CloudWatch Agent can be used to push logs from EC2 instances, but it requires an IAM role with appropriate permissions, such as 'logs:PutLogEvents' and 'logs:CreateLogStream'.