Exam AWS-SysOps topic 1 question 859 discussion

Ans: C https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/UseCloudWatchUnifiedAgent.html

Option B involves using Amazon CloudWatch Events to capture EC2 instance state change events. When an EC2 instance is terminated, a state change event is triggered, and you can configure a CloudWatch Events rule to respond to this event. By setting up a CloudWatch Events rule with a target to transfer the logs to Amazon S3 when an EC2 instance state changes to "terminated," you can automatically copy the application logs to Amazon S3 for future analysis. This ensures that even when the instances are terminated, you have a reliable and durable storage location for the logs.

C is the answer

"... upon an EC2 state change to terminated" , once the EC2 instance is terminated Lambda function will not be able to pull any logs cause logs will be long gone alongside the EC2 instance. Only way is pulling/pushing the logs as soon as events occur. Hence the answer is C.

Why not b? Create a rule that trigger a lambda function that transfer the logs to a S3 bucket. https://docs.aws.amazon.com/autoscaling/ec2/userguide/cloud-watch-events.html

C. Configure the unified CloudWatch agent to stream the logs to Amazon CloudWatch Logs.

I'll go with C

Ans C: CloudWatch agent to write logs to the Cloudwatch

C is looking efficient...