Question 476:
<span dir="LTR">You have enabled CloudTrail in your AWS account and stored the trail logs in CloudWatch Logs. In the CloudWatch Log Group, you plan to create a new subscription filter to deliver the logs to an Amazon Kinesis stream for real-time processing. You have a Kinesis stream in place and the stream ARN is </span><span dir="LTR">"arn:aws:kinesis:us-east-1:123456789012:stream/Test"</span><span dir="LTR">. When creating the subscription filter through AWS CLI </span><span dir="LTR">"aws logs put-subscription-filter"</span><span dir="LTR">, you need an IAM role to provide the required permission. Which IAM permission policy should the IAM role have?</span>
Answer options:
A.{
"Statement": [
{
"Effect": "Allow",
"Action": "kinesis:CreateStream",
"Resource": "arn:aws:kinesis:us-east-1:123456789012:stream/Test"
}
]
}
B.{
"Statement": [
{
"Effect": "Deny",
"Action": "kinesis:PutRecord",
"Condition": {"ArnNotEquals": {"aws:SourceArn": "arn:aws:kinesis:us-east-1:123456789012:stream/Test"}}
}
]
}
C.{
"Statement": [
{
"Effect": "Allow",
"Action": "kinesis:PutRecord",
"Resource": "arn:aws:kinesis:us-east-1:123456789012:stream/Test"
}
]
}
D.{
"Statement": [
{
"Effect": "Allow",
"Action": "kinesis:PutRecord",
"Principal": "arn:aws:kinesis:us-east-1:123456789012:stream/Test",
"Resource": "logs.us-east-1.amazonaws.com"
}
]
}