Amazon SCS-C02 Exam - Topic 6 Question 5 Discussion

Actual exam question for Amazon's SCS-C02 exam

Question #: 5
Topic #: 6

A security engineer logs in to the AWS Lambda console with administrator permissions. The security engineer is trying to view logs in Amazon CloudWatch for a Lambda function that is named my Function.

When the security engineer chooses the option in the Lambda console to view logs in CloudWatch, an ''error loading Log Streams" message appears.

The IAM policy for the Lambda function's execution role contains the following:

How should the security engineer correct the error?

AMove the logs:CreateLogGroup action to the second Allow statement.

BAdd the logs:PutDestination action to the second Allow statement.

CAdd the logs:GetLogEvents action to the second Allow statement.

DAdd the logs:CreateLogStream action to the second Allow statement.

Show Suggested Answer

Suggested Answer: D

CloudWatchLogsReadOnlyAccess doesn't include 'logs:CreateLogStream' but it includes 'logs:Get*' https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/iam-identity-based-access-control-cwl.html#:~:text=oam%3A*%3A*%3Asink/*%22%0A%20%20%20%20%20%20%20%20%7D%0A%20%20%20%20%5D%0A%7D-,CloudWatchLogsReadOnlyAccess,-The%20CloudWatchLogsReadOnlyAccess%20policy

by Lonna at Oct 07, 2023, 08:45 AM

Limited Time Offer

25%

Off

Get Premium SCS-C02 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Jame

3 months ago

Why would it throw an error if permissions are set? Sounds odd.

upvoted 0 times

...

Martina

3 months ago

Seems like a permissions issue, D makes sense.

upvoted 0 times

...

Aleta

4 months ago

Wait, are you sure? I thought it was logs:GetLogEvents.

upvoted 0 times

...

Cortney

4 months ago

Definitely option D, that’s the right action!

upvoted 0 times

...

Leonora

4 months ago

You need logs:CreateLogStream for CloudWatch access.

upvoted 0 times

...

Yun

4 months ago

I think I read that the logs:GetLogEvents action is crucial for viewing logs. But I’m not sure if that’s the only thing we need to add.

upvoted 0 times

...

Dick

4 months ago

I feel like the error could be due to missing permissions for log streams. But I’m not entirely confident if that's the right action to take.

upvoted 0 times

...

Deandrea

5 months ago

This question seems familiar. I practiced a similar one where we had to adjust IAM policies for Lambda functions. I’m not sure if it’s option D or C though.

upvoted 0 times

...

Margret

5 months ago

I remember something about permissions needing to be set correctly for CloudWatch logs. I think it might be related to creating log streams?

upvoted 0 times

...

Ora

5 months ago

Got it, I think I know what's going on here. The policy is missing the necessary permissions to create and access the CloudWatch log streams. I'll need to add the appropriate logs:* actions to the second Allow statement to fix this issue.

upvoted 0 times

...

Tayna

5 months ago

Ugh, I'm a bit confused by this one. The IAM policy looks complex, and I'm not entirely sure which action I need to add to resolve the error. I'll need to carefully review the documentation to make sure I understand the right solution.

upvoted 0 times

...

Lai

5 months ago

Alright, time to put my AWS knowledge to the test. Based on the error and the policy, I think the issue is that the policy is missing the necessary permissions to access the CloudWatch logs. I'll need to figure out which specific action is required to fix this.

upvoted 0 times

...

Adelle

5 months ago

Hmm, this looks like a tricky one. I'll need to carefully review the IAM policy and the error message to figure out the right approach.

upvoted 0 times

...

Lilli

5 months ago

Okay, let's see here. The error message says the logs can't be loaded, so it seems like the IAM policy is missing some necessary permissions. I'll need to analyze the policy closely to determine what's missing.

upvoted 0 times

...

Sage

5 months ago

Okay, let's see. I think the key here is to make sure the columns are properly configured in the form. I'll need to double-check that.

upvoted 0 times

...

Suzi

5 months ago

I'm a bit confused by the abstract class and interface. I'll need to review those concepts before I can confidently select the right answer.

upvoted 0 times

...

Enola

5 months ago

Hmm, I'm not totally sure about this one. I know there are a few different ways to get the row count, but I'm not confident which one is the best option for this specific table structure. I'll have to think it through carefully.

upvoted 0 times

...

Annamae

5 months ago

Wait, what's this about a "switching function" for mobile IoT? I'm not sure I understand that one. I'll have to read through the options again more closely.

upvoted 0 times

...