SOA-C02 Monitoring, Logging, and Remediation Practice Question

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "logs:PutLogEvents",
      "Resource": "arn:aws:logs:us-east-1:123456789012:log-group:MyAppLogGroup:*"
    },
    {
      "Effect": "Allow",
      "Action": "logs:CreateLogStream",
      "Resource": "arn:aws:logs:us-east-1:123456789012:log-group:MyAppLogGroup:*"
    }
  ]
}

Refer to the exhibit. An EC2 instance is running the CloudWatch Logs agent and uses the IAM policy shown. The agent is configured to send logs to the log group 'MyAppLogGroup'. However, logs are not appearing. What is the MOST likely cause?

⚠ Common exam trap

Many exam-takers assume `logs:PutLogEvents` alone is sufficient for sending logs, overlooking the fact that the agent must first create the log group and log stream if they do not exist, which requires additional permissions.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The policy is missing permission to create the log group if it does not exist.

The CloudWatch Logs agent cannot automatically create a log group; it requires explicit permission via the `logs:CreateLogGroup` action in the IAM policy. Without this permission, if the log group 'MyAppLogGroup' does not already exist, the agent will fail to send logs, even though the `logs:PutLogEvents` action is allowed. The policy shown only grants `logs:PutLogEvents` and `logs:DescribeLogStreams`, missing the necessary `logs:CreateLogGroup` and `logs:CreateLogStream` actions for initial setup.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The log group name in the policy does not match the agent configuration.
Why it's wrong here
The policy's Resource ARN explicitly targets MyAppLogGroup, and the CloudWatch agent's configuration is set to stream logs to the same log group name. For a mismatch to cause the error, the agent would need to be configured with a different log group name, but the scenario does not indicate this. Therefore, this option does not explain the access issue; the names are aligned and the policy correctly matches the intended log group.
✗
The policy does not allow the 'logs:PutLogEvents' action.
Why it's wrong here
The attached policy explicitly includes the 'logs:PutLogEvents' action in its Statement, granting the agent permission to append log events to a log stream. Since the required action for sending log data is present, a missing PutLogEvents permission is not the cause of the failure. The real problem is that the policy omits the separate 'logs:CreateLogGroup' action needed for the agent to create the log group on first use.
✓
The policy is missing permission to create the log group if it does not exist.
Why this is correct
CloudWatch agent requires 'logs:CreateLogGroup' to create the specified log group when it does not already exist. The policy in question grants only 'logs:CreateLogStream' and 'logs:PutLogEvents', but not 'logs:CreateLogGroup', so the agent cannot provision the MyAppLogGroup on startup. As a result, the agent fails to deliver any log data, making the missing CreateLogGroup permission the correct explanation for the issue.
✗
The Resource ARN incorrectly specifies a wildcard after the log group name.
Why it's wrong here
The Resource ARN 'arn:aws:logs:region:account-id:log-group:MyAppLogGroup:*' uses the wildcard to represent all log streams under the MyAppLogGroup log group. This is the correct ARN pattern for granting access to log streams, because log streams are child resources of a log group and require a wildcard after the log group name. Removing the wildcard would restrict permissions to the log group resource itself and would not cover any streams, so this is not a misconfiguration.

Go deeper

SOA-C02 Monitoring, Logging, and Remediation Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question