CloudWatch Logs in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

CloudWatch Logs Retention Behavior

You have a CloudWatch Logs group with a retention period set to 7 days. What happens to the logs older than 7 days?

A Logs older than 7 days remain indefinitely until manually deleted.

B Logs older than 7 days are archived to S3 automatically.

C Logs older than 7 days are automatically deleted by CloudWatch Logs.

D Logs older than 7 days are moved to a Glacier storage class.

💡 Hint

Think about how retention policies work in CloudWatch Logs.

CloudWatch Logs retention policies automatically delete logs older than the set retention period. They do not archive or move logs to other storage services.

❓ Configuration

intermediate

CloudWatch Logs Metric Filter Configuration

You want to create a metric filter in CloudWatch Logs to count the number of ERROR messages in your application logs. Which filter pattern correctly matches lines containing the word 'ERROR'?

A ?ERROR

B [ERROR]

C { $.level = "ERROR" }

D "ERROR"

💡 Hint

Metric filter patterns use simple string matching or JSON syntax.

The pattern "ERROR" matches any log line containing the word ERROR. The other options are either invalid syntax or incorrect pattern types.

❓ Architecture

advanced

Designing Centralized Log Storage with CloudWatch Logs

You have multiple AWS accounts generating logs. You want to centralize all logs into a single CloudWatch Logs account for monitoring and analysis. Which architecture best achieves this?

A Use CloudWatch Logs subscription filters in each account to stream logs to a central account's Kinesis Data Firehose delivery stream.

B Manually export logs from each account to S3 and then import them into the central account's CloudWatch Logs.

C Set the retention period to infinite in each account and access logs remotely from the central account.

D Create CloudWatch Dashboards in each account and aggregate data manually.

💡 Hint

Think about streaming logs in real-time to a central location.

Subscription filters can stream logs from multiple accounts to a central Kinesis Data Firehose, which then delivers logs to the central account's storage or analysis tools.

❓ security

advanced

Securing CloudWatch Logs Access

You want to restrict access so that only a specific IAM role can read logs from a CloudWatch Logs group. Which policy element correctly restricts access?

AWS

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["logs:GetLogEvents", "logs:FilterLogEvents"],
      "Resource": "arn:aws:logs:us-east-1:123456789012:log-group:MyAppLogs:*",
      "Condition": {
        "StringEquals": {
          "aws:PrincipalArn": "arn:aws:iam::123456789012:role/SpecificRole"
        }
      }
    }
  ]
}

A The policy allows any IAM user in the account to read logs from 'MyAppLogs'.

B The policy allows only the IAM role 'SpecificRole' to read logs from 'MyAppLogs' log group.

C The policy denies all access to 'MyAppLogs' log group.

D The policy allows all actions on all log groups in the account.

💡 Hint

Look at the Condition element restricting access by principal ARN.

The Condition element restricts access to only the specified IAM role by matching the principal ARN. This ensures only that role can perform the allowed actions.

✅ Best Practice

expert

Optimizing CloudWatch Logs Cost and Performance

You have a high volume of logs generating in CloudWatch Logs. To reduce costs and improve query performance, which approach is best?

A Use subscription filters to send logs to an Amazon S3 bucket with lifecycle policies and query logs using Athena.

B Increase the retention period to keep logs longer in CloudWatch Logs.

C Disable all metric filters to reduce processing costs.

D Store logs only in CloudWatch Logs with no export or archiving.

💡 Hint

Think about offloading logs to cheaper storage and using efficient query tools.

Exporting logs to S3 with lifecycle policies reduces storage costs. Querying logs with Athena is cost-effective and performant compared to querying directly in CloudWatch Logs.