SOA-C03 practice question: CloudWatch agent and log collection (2 of 2)
Monitoring, Logging, Analysis, Remediation, and Performance Optimization A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A pet insurer moved its claims workers to private subnets that have no NAT gateway and no internet gateway. The CloudWatch agent on the instances should send application logs to CloudWatch Logs. The instance role includes CloudWatchAgentServerPolicy, and Systems Manager works through existing interface endpoints.
No logs arrive, and the agent's own log shows repeated connection timeouts to logs.us-east-2.amazonaws.com.
What should a CloudOps engineer do to fix this with the LEAST change?
Choose one answer.
AA. Create an interface VPC endpoint for CloudWatch Logs with private DNS, and allow HTTPS to it from the instances.
BB. Attach the CloudWatchLogsFullAccess managed policy to the instance role so that the agent can create log groups and streams.
CC. Create a gateway VPC endpoint for CloudWatch Logs and add it to the route tables of the private subnets.
DD. Add a NAT gateway in a public subnet, add an internet gateway to the VPC, and route the private subnets' 0.0.0.0/0 traffic to it.
Show the answer and explanation
Answer: A
A. Right: Correct. The timeouts show the agent cannot reach the public Logs endpoint. An interface endpoint with private DNS makes the usual service name resolve to private IP addresses inside the VPC, so the agent works without configuration changes. Learn more: Using CloudWatch Logs with interface VPC endpoints (opens in a new tab)
C. Wrong: Gateway endpoints exist only for Amazon S3 and DynamoDB. CloudWatch Logs is reached privately through an interface endpoint, so this endpoint type cannot be created for it. Learn more: Gateway endpoints (opens in a new tab)
D. Wrong: A NAT gateway would let the agent reach the public endpoint, but it adds internet egress the design deliberately removed. It is also more change and cost than one interface endpoint. Learn more: NAT gateways (opens in a new tab)
Explanation
Connection timeouts point at network reachability, not permissions. In subnets with no internet path, every AWS service the instance calls needs a VPC endpoint, just as Systems Manager already has. CloudWatch Logs supports interface endpoints, and with private DNS the agent keeps using the standard endpoint name.
The agent's calls to CloudWatch Logs time out until an interface endpoint gives the private subnets a path to the service.
Want more on CloudWatch agent and log collection? The 5 full-length practice sets have 6 more CloudWatch agent and log collection questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →