AWS Certified Sysops Administrator Associate · Free Practice Question Medium
Question 55
A retail company has complex AWS VPC architecture that is getting difficult to maintain. The company has decided to configure VPC flow logs to track the network traffic to analyze various traffic flow scenarios. The systems administration team has configured VPC flow logs for one of the VPCs, but it's not able to see any logs. After initial analysis, the team has been able to track the error. It says Access error and the administrator of the team wants to change the IAM Role defined in the flow log definition.
What is the correct way of configuration a solution for this issue so that the VPC flow logs can be operational?
-
A
The error indicates an internal error has occurred in the flow logs service. Raise a service request with AWS
-
B
The flow log is still in the process of being created. It sometimes takes almost 10 minutes to start the logs
-
C
The error indicates IAM role is not correctly configured. After you've created a flow log, you cannot change its configuration. Instead, you need to delete the flow log and create a new one with the required configuration
-
D
The error indicates that the IAM role does not have a trust relationship with the flow logs service. Change the trust relationship from flow log configuration
Reveal correct answer
Correct answer: C
Explanation
Correct option:
The error indicates the IAM role is not correctly configured. After you've created a flow log, you cannot change its configuration. Instead, you need to delete the flow log and create a new one with the required configuration
Access error can be caused by one of the following reasons:
The IAM role for your flow log does not have sufficient permissions to publish flow log records to the CloudWatch log group
The IAM role does not have a trust relationship with the flow logs service
The trust relationship does not specify the flow logs service as the principal
After you've created a flow log, you cannot change its configuration or the flow log record format. For example, you can't associate a different IAM role with the flow log or add or remove fields in the flow log record. Instead, you can delete the flow log and create a new one with the required configuration.
Incorrect options:
The error indicates that the IAM role does not have a trust relationship with the flow logs service. Change the trust relationship from flow log configuration - As discussed above, the VPC flow log configuration cannot be changed once created.
The flow log is still in the process of being created. It sometimes takes almost 10 minutes to start the logs - This scenario is possible when you have just configured the flow logs. However, the status of the flow logs will not be in an error state.
The error indicates an internal error has occurred in the flow logs service. Raise a service request with AWS - This is a made-up option, given only as a distractor.
References:
https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-troubleshooting.html
https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html#flow-log-records
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
