Troubleshooting missing logs and alerts: SCS-C03 study notes and practice questions
What to know about Troubleshooting missing logs and alerts for the SCS-C03 exam, from the Detection domain (16% of the exam guide), then 1 free question to test it. Part of the SCS-C03 study guide.
These questions describe a symptom: a trail that stopped delivering, an instance that logs nothing, an alarm that never fires or a rule that misses events from another account. You find the broken hop in the chain, which is usually a permission, an encryption key, a network path or a pattern that doesn’t match the real data.
Work the chain in order
The source emits events. The trail is logging, the instance runs the agent, or the flow log is active in the right resource.
The delivery permission exists. The bucket policy, IAM role or resource policy allows the service to write.
The destination accepts the data. The log group exists, the bucket is reachable and the KMS key policy allows encryption use.
The filter or rule matches the real format. A metric filter pattern may expect JSON while the logs are plain text.
The alarm or target evaluates the right thing. The metric, period and missing-data setting match the intent.
Common causes by source
CloudTrail: the trail’s logging status is off, the bucket policy no longer allows CloudTrail to write, or the bucket uses SSE-KMS and the key policy omits CloudTrail.
CloudWatch agent on EC2: the instance profile lacks CloudWatch permissions, the agent configuration lists the wrong file paths, or the agent is not running. A private subnet also needs a route to CloudWatch Logs, through NAT or an interface VPC endpoint for CloudWatch Logs.
VPC Flow Logs: the delivery role cannot publish to the log group, or the S3 bucket policy blocks delivery. New records appear with a delay.
Metric filters and alarms: the filter pattern doesn’t match the log format, the filter was created after the events, or the alarm’s missing-data setting hides a silent feed.
EventBridge: the rule is in the wrong Region, the event pattern uses the wrong field names, the target lacks permission, or a cross-account event bus has no resource policy.
Retention: logs expired because the log group retention is shorter than the investigation window.
How to choose
Scenario wording
Pick
Trail stopped delivering to an encrypted bucket
Check the trail’s logging status and the KMS key policy for CloudTrail
EC2 agent runs, but no logs arrive
Instance profile permissions and the network path to CloudWatch Logs
Instances in private subnets can’t send logs
An interface VPC endpoint for CloudWatch Logs, or a NAT route
The alarm never fires although the logs exist
Compare the filter pattern with the actual log format
A rule never sees events from a member account
Event bus resource policy and target permissions
Logs needed for an older incident are gone
Log group retention was shorter than the investigation window
Common traps
Blaming the alarm when the filter pattern is the real problem.
Changing security group rules on a private instance when the real gap is the missing endpoint for CloudWatch Logs.
Ignoring the KMS key policy when the destination bucket or log group uses a customer managed key.
Granting permissions to a user when the instance role is the identity that writes the logs.
A game studio runs a fleet of Amazon EC2 Linux game servers in private subnets, built from a new image. The servers reach CloudWatch Logs through an interface VPC endpoint. The CloudWatch agent is installed, but its log shows AccessDenied errors whenever it tries to send game logs to a log group.
The studio's rule is that no long-term access key may be stored on any server. The security engineer must fix the agent without changing the game code, and must not widen access beyond what the agent needs.
Which THREE checks should the security engineer make? (Choose three.)
Choose three answers.
AA. Confirm that each instance has an instance profile whose role allows logs:CreateLogStream, logs:PutLogEvents and logs:DescribeLogStreams for the game log group.
BB. Store the root account access keys in the agent configuration file, so that the agent can always authenticate to CloudWatch Logs without an instance profile.
CC. Attach a service control policy to the organization that allows logs:* so that the agent receives the permissions it lacks.
DD. Confirm that the Resource element in the role policy matches the log group name that the agent configuration actually uses, including its log streams.
EE. Turn on detailed monitoring for each instance, since detailed monitoring sends the game log lines to CloudWatch Logs automatically.
FF. Confirm that the policy on the CloudWatch Logs interface endpoint allows the logs actions for this log group from the game server role.
Show the answer and explanation
Answers: A, D, F
A. Right: Correct. The agent takes temporary credentials from the instance profile, so a missing role or missing actions cause AccessDenied on every log call. Granting only these logs actions keeps the access narrow. Learn more: Using roles for Amazon EC2 (opens in a new tab)
B. Wrong: This would clear the error, but it stores a long-term root credential on every server, which the studio rule forbids. Root credentials should never be used by applications or agents.
C. Wrong: Service control policies do not grant permissions. They only limit what identities could be allowed to do, so this change fixes nothing on the servers and it widens the allowed actions across the organization.
D. Right: Correct. A policy scoped to a different log group name, or one that leaves out the log-stream part of the ARN, denies the agent calls even though the actions are listed. Matching the ARN fixes the error without widening access.
E. Wrong: Detailed monitoring sends EC2 instance metrics to CloudWatch every minute, not log lines. It does not change the agent permissions or the agent configuration, so the errors would continue.
F. Right: Correct. An endpoint policy is checked on every call that passes through the interface endpoint, and a restrictive policy returns AccessDenied even when the role allows the action. Allowing the agent actions there keeps the rest of the endpoint policy intact. Learn more: Control access to VPC endpoints using endpoint policies (opens in a new tab)
Explanation
AccessDenied from the CloudWatch agent comes from a policy that does not allow the call: the instance profile role, the resource ARN that role names, or the policy on the VPC endpoint in the path. Checking those three fixes the error without long-term keys or wider access. Root keys, service control policies and detailed monitoring either break a requirement or do not address the error.
Want more on Troubleshooting missing logs and alerts? The 5 full-length practice sets have 7 more Troubleshooting missing logs and alerts questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →