Question

A company uses Amazon Elastic Container Service (Amazon ECS) with the Amazon EC2 launch type. The company requires all log data to be centralized in Amazon CloudWatch. The company’s ECS tasks include a `LogConfiguration` object that specifies `awslogs` as the log driver name. The company’s ECS tasks failed to deploy. An error message states that a missing permission caused the failure. The company verified that the IAM role used to launch container instances includes the `logs:CreateLogGroup`, `logs:CreateLogStream`, and `logs:PutLogEvents` permissions. Which solution will resolve the problem?

Accepted Answer

A. Add an IAM trust policy to the IAM role that establishes Amazon ECS as a trusted service.

Answer

Add the logs:PutDestination permission to the policy applied to the IAM role.

Answer

Remove the logs:CreateLogStream permission from the policy applied to the IAM role.

Answer

Add an IAM trust policy to the IAM role that establishes CloudWatch as a trusted service.