SCS-C02 Question 107
Single answerYour organization has implemented AWS CloudTrail for monitoring API activity in the AWS account. You notice that critical events such as 'DeleteBucket' are not triggering CloudWatch alarms as expected. Upon investigation, you find that the CloudWatch log group associated with the CloudTrail logs is not generating any metrics for the intended alarms. What is the most likely cause of this issue, and how can you resolve it?
- A
The CloudTrail trail is not configured to deliver logs to the associated CloudWatch log group.
- B
The IAM role used by CloudTrail does not have the necessary permissions to write logs to the CloudWatch log group.
- C
Metric filters are not configured in CloudWatch for the specific events you want to monitor and alert on.
- D
The CloudWatch alarm is not using the correct SNS topic for notification.
Show answer and explanation
Correct answer: C
Explanation
To troubleshoot security monitoring and alerting issues, it's essential to ensure that all components in the monitoring pipeline are configured correctly. In this scenario, the absence of metric filters in CloudWatch explains why the specific events are not generating metrics, leading to the failure of alarms. Configuring metric filters for the relevant events would resolve the problem.
- A. Incorrect.
This is unlikely because the issue described is that the CloudWatch log group is not generating metrics, which indicates the logs are being delivered but metrics are not being created.
- B. Incorrect.
This is not the issue because CloudTrail is delivering logs to the CloudWatch log group, as inferred from the scenario.
- C. Correct.
This is the most likely cause. Without metric filters in CloudWatch, no metrics are generated for specific events like 'DeleteBucket,' and therefore, alarms cannot function.
- D. Incorrect.
While incorrect SNS topic configuration could prevent an alarm from sending notifications, it would not explain why the log group isn't generating metrics.