Question

A security engineer must centralize application logs from a fleet of Amazon Linux 2 EC2 instances into CloudWatch Logs so that a metric filter can trigger alarms on repeated authentication failures. After installing and starting the unified CloudWatch agent on the instances, the engineer confirms the agent process is running, but no log groups or log events appear in CloudWatch Logs. The agent configuration file correctly references the application log file path. What is the MOST likely cause of the missing logs?

Accepted Answer

The EC2 instance profile (IAM role attached to the instances) lacks the logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents permissions.

Answer

CloudWatch Logs does not support ingestion from EC2 instances unless a VPC interface endpoint is created for the CloudTrail service.

Answer

The metric filter must be created before the agent starts, otherwise CloudWatch discards incoming log events.

Answer

Log data must first be delivered to an S3 bucket, and CloudWatch Logs subscriptions pull the events from S3 automatically.