Which combination of steps should the security engineer take to troubleshoot this issue?
(Choose three.)
Ensure that the EC2 instance profile that is attached to the EC2 instances has permissions to create log streams and write logs.
Create a metric filter on the logs so that they can be viewed in the AWS Management Console.
Check the CloudWatch agent configuration file on each EC2 instance to make sure that the CloudWatch agent is collecting the proper log files.
Check the VPC endpoint policies of both VPC endpoints to ensure that the EC2 instances have permissions to use them.
Create a NAT gateway in the subnet so that the EC2 instances can communicate with CloudWatch.
Ensure that the security groups allow all the EC2 instances to communicate with each other to aggregate logs before sending.
Explanations:
The EC2 instance profile must have the necessary IAM permissions to create log streams and write logs to CloudWatch Logs. If these permissions are not granted, the logs will not be successfully sent to CloudWatch.
The CloudWatch agent configuration file on the EC2 instances must specify the correct log files to be collected. If the agent is misconfigured, it may not capture or send the logs to CloudWatch.
The VPC endpoint policies must allow the EC2 instances to access CloudWatch monitoring and CloudWatch logs. If the endpoint policies are too restrictive, the EC2 instances will be unable to send logs to CloudWatch.
A metric filter is used for creating metrics based on log data, not for troubleshooting log visibility in CloudWatch. It does not help in the context of missing logs.
A NAT gateway is not required since the VPC endpoints already provide private connectivity to CloudWatch services. The EC2 instances do not need to access the internet, as the VPC endpoints handle the communication.
Security groups are not required for EC2 instances to communicate with each other for log aggregation. The logs are sent directly from the CloudWatch agent to CloudWatch services, not through inter-instance communication.