DOP-C02 Question 234
Select 2Your organization uses Amazon CloudWatch Logs to collect and monitor application logs. You are tasked with setting up a mechanism to allow an EC2 instance to push application logs to CloudWatch Logs securely. Which of the following steps will ensure the instance has the required permissions while adhering to security best practices?
- A
Attach the AmazonCloudWatchLogsFullAccess policy directly to the EC2 instance.
- B
Create an IAM role with a policy that grants write access to CloudWatch Logs and attach it to the EC2 instance.
- C
Create an IAM role with least privilege permissions for CloudWatch Logs and attach it to the EC2 instance.
- D
Add the EC2 instance to a security group that allows outbound access to CloudWatch Logs endpoints.
- E
Use an instance profile to associate the IAM role with the EC2 instance.
Show answer and explanation
Correct answers: C, E
Explanation
To securely allow an EC2 instance to push logs to CloudWatch Logs, you must create an IAM role with least privilege permissions for CloudWatch Logs (Option 3) and associate this role with the EC2 instance using an instance profile (Option 5). This ensures the instance has only the permissions it needs and adheres to security best practices. Directly attaching policies to instances is not possible, and network configurations like security groups do not handle IAM permissions.
- A. Incorrect.
Attaching the AmazonCloudWatchLogsFullAccess policy directly to the EC2 instance is not possible because IAM policies cannot be attached directly to EC2 instances. Additionally, granting full access is not aligned with security best practices.
- B. Incorrect.
Creating an IAM role with a policy that grants write access to CloudWatch Logs is a good approach, but the policy should follow the principle of least privilege. This option does not mention least privilege, so it is not the best choice.
- C. Correct.
Creating an IAM role with least privilege permissions for CloudWatch Logs ensures the EC2 instance has only the necessary permissions, aligning with security best practices.
- D. Incorrect.
Adding the EC2 instance to a security group that allows outbound access to CloudWatch Logs endpoints is not a valid way to grant permissions for log collection. Security groups manage network traffic, not IAM permissions.
- E. Correct.
Using an instance profile to associate the IAM role with the EC2 instance is necessary for the EC2 instance to assume the role and obtain temporary credentials to access CloudWatch Logs.