AWS Certified CloudOps Engineer Associate SOA-C03 Practice Question

An operations team manages an Amazon ECS cluster that uses the EC2 launch type. They need to collect host-level CPU, memory, disk, and network metrics and forward all container application logs to Amazon CloudWatch Logs. The solution must start automatically on every new container instance without requiring changes to existing application task definitions. Which approach meets these requirements with the least operational effort?

Add the CloudWatch agent as a sidecar container to every existing and future application task definition so it starts alongside each application task.
Create a task definition that runs the unified CloudWatch agent (with Fluent Bit) and deploy it as an ECS service that uses the DAEMON scheduling strategy. Store the agent configuration in Parameter Store and grant the task IAM permissions to write to CloudWatch.
Edit the configuration file of the Amazon ECS agent on every container instance so that it emits host metrics and container logs directly to CloudWatch.
Use EC2 user data to install and start the CloudWatch agent on each container instance when it boots.

Report Issue

Answer Description

Running the unified CloudWatch agent as its own task with the DAEMON scheduling strategy ensures that one copy of the agent (and optional Fluent Bit container) is launched on every container instance in the cluster. The agent configuration can be stored in AWS Systems Manager Parameter Store, and the task's IAM role needs permissions such as CloudWatchAgentServerPolicy. Because the agent is deployed independently of the application task definitions, no modification of those tasks is required, and every new EC2-based container instance automatically starts collecting and publishing the required metrics and logs.

Embedding the agent as a sidecar in each application task would meet the functional requirement but would require editing every task definition and updating them whenever new services are added. Installing the agent once with user data or by manually updating the ECS agent does not guarantee that future instances receive the agent without additional steps and does not automatically collect container logs. Therefore, deploying the CloudWatch agent as a DAEMON task is the most operationally efficient solution.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.