Exam AWS Certified Solutions Architect - Professional topic 1 question 969 discussion

Exam question from Amazon's AWS Certified Solutions Architect - Professional

Question #: 969
Topic #: 1

[All AWS Certified Solutions Architect - Professional Questions]

A company is running a web application on Amazon EC2 instances in a production AWS account. The company requires all logs generated from the web application to be copied to a central AWS account for analysis and archiving. The company's AWS accounts are currently managed independently. Logging agents are configured on the EC2 instances to upload the log files to an Amazon S3 bucket in the central AWS account.

A solutions architect needs to provide access for a solution that will allow the production account to store log files in the central account. The central account also needs to have read access to the log files.

What should the solutions architect do to meet these requirements?

A. Create a cross-account role in the central account. Assume the role from the production account when the logs are being copied.
B. Create a policy on the S3 bucket with the production account ID as the principal. Allow S3 access from a delegated user.
C. Create a policy on the S3 bucket with access from only the CIDR range of the EC2 instances in the production account. Use the production account ID as the principal.
D. Create a cross-account role in the production account. Assume the role from the production account when the logs are being copied.

Show Suggested Answer

Suggested Answer: A 🗳️

by masetromain at Nov. 30, 2022, 3:59 p.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

3a632a3

1 year, 6 months ago

Selected Answer: B

Log agents may not have the ability to do cross account assume roles, but A is possible although the recommended method is to use cross account bucket permissions. https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-walkthroughs-managing-access-example2.html

upvoted 1 times

...

tonixxx

1 year, 9 months ago

A is the correct answer for sure. The steps to do: - in the central account create: Trust relationships with the principal is prod accountID. IAM -> Roles -> Create Role -> AWS account -> Another account -> fill in prod accountID ( central account is trusting account ) - in the prod account click switch role and fill in the AccountID of the central account, the role name from the above step ( prod accountID is the trusted account)

upvoted 1 times

...

SkyZeroZx

2 years ago

Selected Answer: A

A: The production account should be able to assume the central account's role.

upvoted 2 times

...

Jesuisleon

2 years, 1 month ago

for https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html, do you guys really read it carefully ? This link supports A not D !

upvoted 3 times

...