Q77 — AWS SAA-C03 Ch.13

Question 77 of 100 | ← Chapter 13

Q977. A company recently migrated a monolithic application to microservices.The updated application uses an event-driven architecture.The company wants to follow the principle of least privilege to secure resources for the application.The company began to remove unnecessary permissions after the migration.After the company removed some permissions,the company noticed that an Amazon CloudWatch log group stopped receiving log messages for one of the company's AWS Lambda functions. After the permission changes, the Throttles metric for the function was 2,and the Invocations metric was 2.What is the likely reason that the CloudWatch log group stopped receiving log messages from the Lambda function?

• A. The IAM role for the Lambda function does not have the correct policy to send log messages to the CloudWatch log group. ✓
• B. The resource-based policy for the Lambda function does not have the correct policy to send log messages to the CloudWatch log group.
• C. The IAM role for the CloudWatch log group does not have the correct policy to receive log messages from the Lambda function.
• D. The IAM role for the service that attempts to invoke the Lambda function does not have the correct policy to allow the service to invoke the Lambda function.

Correct Answer: A. The IAM role for the Lambda function does not have the correct policy to send log messages to the CloudWatch log group.

Explanation

The correct answer is:A. The IAM role for the Lambda function does not have the correct policy to send log messages to the CloudWatch log group.Explanation:A. The IAM role for the Lambda function does not have the correct policy to send log messages to the CloudWatch log group.- This is the likely reason that the CloudWatch log group stopped receiving log messages from the Lambda function. After the permission changes, the Throttles metric for the function was 2, and the Invocations metric was 2, indicating that the Lambda function was being invoked but not able to send logs to the CloudWatch log group.B. The resource-based policy for the Lambda function does not have the correct policy to send log messages to the CloudWatch log group.- This is not the likely reason, as the resource-based policy for the Lambda function would not affect its ability to send logs to the CloudWatch log group.C. The IAM role for the CloudWatch log group does not have the correct policy to receive log messages from the Lambda function.- This is not the likely reason, as the IAM role for the CloudWatch log group would not prevent the Lambda function from sending logs to the log group.D. The IAM role for the service that attempts to invoke the Lambda function does not have the correct policy to allow the service to invoke the Lambda function.- This is not the likely reason, as the issue is with the Lambda function's ability to send logs to the CloudWatch log group, not with invoking the Lambda function.In summary, the likely reason that the CloudWatch log group stopped receiving log messages from the Lambda function is that the IAM role for the Lambda function does not have the correct policy to send log messages to the CloudWatch log group.