A game studio runs a fleet of Amazon EC2 Linux game servers in private subnets, built from a new image. The servers reach CloudWatch Logs through an interface VPC endpoint. The CloudWatch agent is installed, but its log shows AccessDenied errors whenever it tries to send game logs to a log group.
The studio's rule is that no long-term access key may be stored on any server. The security engineer must fix the agent without changing the game code, and must not widen access beyond what the agent needs.
Which THREE checks should the security engineer make? (Choose three.)
Choose three answers.
AA. Confirm that each instance has an instance profile whose role allows logs:CreateLogStream, logs:PutLogEvents and logs:DescribeLogStreams for the game log group.
BB. Store the root account access keys in the agent configuration file, so that the agent can always authenticate to CloudWatch Logs without an instance profile.
CC. Attach a service control policy to the organization that allows logs:* so that the agent receives the permissions it lacks.
DD. Confirm that the Resource element in the role policy matches the log group name that the agent configuration actually uses, including its log streams.
EE. Turn on detailed monitoring for each instance, since detailed monitoring sends the game log lines to CloudWatch Logs automatically.
FF. Confirm that the policy on the CloudWatch Logs interface endpoint allows the logs actions for this log group from the game server role.
Show the answer and explanation
Answers: A, D, F
A. Right: Correct. The agent takes temporary credentials from the instance profile, so a missing role or missing actions cause AccessDenied on every log call. Granting only these logs actions keeps the access narrow. Learn more: Using roles for Amazon EC2 (opens in a new tab)
B. Wrong: This would clear the error, but it stores a long-term root credential on every server, which the studio rule forbids. Root credentials should never be used by applications or agents.
C. Wrong: Service control policies do not grant permissions. They only limit what identities could be allowed to do, so this change fixes nothing on the servers and it widens the allowed actions across the organization.
D. Right: Correct. A policy scoped to a different log group name, or one that leaves out the log-stream part of the ARN, denies the agent calls even though the actions are listed. Matching the ARN fixes the error without widening access.
E. Wrong: Detailed monitoring sends EC2 instance metrics to CloudWatch every minute, not log lines. It does not change the agent permissions or the agent configuration, so the errors would continue.
F. Right: Correct. An endpoint policy is checked on every call that passes through the interface endpoint, and a restrictive policy returns AccessDenied even when the role allows the action. Allowing the agent actions there keeps the rest of the endpoint policy intact. Learn more: Control access to VPC endpoints using endpoint policies (opens in a new tab)
Explanation
AccessDenied from the CloudWatch agent comes from a policy that does not allow the call: the instance profile role, the resource ARN that role names, or the policy on the VPC endpoint in the path. Checking those three fixes the error without long-term keys or wider access. Root keys, service control policies and detailed monitoring either break a requirement or do not address the error.
Want more on Troubleshooting missing logs and alerts? The 5 full-length practice sets have 7 more Troubleshooting missing logs and alerts questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →