Section: Exam Notes
Section: Practice Tests
Troubleshooting Security Monitoring, Logging, and Alerting in AWS
This section covers the following exam objective:
Domain 1: Detection
Task Statement 1.3: Troubleshoot security monitoring, logging, and alerting solutions
1. Understanding Troubleshooting in AWS Security Monitoring
Troubleshooting in AWS security monitoring focuses on identifying why logs, alerts, or monitoring signals are missing, incorrect, or delayed. In most cloud environments, the root cause is typically misconfiguration, rather than system failure.
What to Expect in Exam Scenarios
You will encounter situations where:
- Logs are not generated or visible
- Alerts are not triggered
- Monitoring is partially functioning
Your objective is to identify issues related to:
- Misconfigurations
- IAM permission problems
- Incorrect service integrations
Common Troubleshooting Areas
| Area | Typical Issue | Root Cause |
|---|---|---|
| Logging | Missing logs | Logging not enabled or misconfigured |
| Permissions | Access denied | IAM role or policy issues |
| Monitoring | No metrics available | Agent not installed or configured |
| Alerting | Alerts not triggered | CloudWatch alarm misconfiguration |
2. Analyzing Resource Functionality
Before applying fixes, validate the following:
- Service configuration
- IAM permissions
- Integration between services
AWS Lambda Logging Issues
| Issue | Cause | Fix |
|---|---|---|
| No logs in CloudWatch | Missing IAM role | Attach AWSLambdaBasicExecutionRole |
| Incomplete logs | Function timeout or errors | Check execution duration and errors |
| Delayed logs | Asynchronous invocation | Review retry behavior |
API Gateway Logging Issues
| Issue | Cause | Fix |
|---|---|---|
| No access logs | Logging not enabled | Enable logging in stage settings |
| No execution logs | Missing IAM role | Attach CloudWatch logging role |
| Partial logs | Incorrect log format | Verify log configuration |
CloudFront Logging Issues
| Issue | Cause | Fix |
|---|---|---|
| No logs generated | Logging disabled | Enable standard logging |
| Logs missing in S3 | Incorrect bucket policy | Update S3 permissions |
| Log delivery delay | Expected behavior | CloudFront logs are delayed by design |
Health Checks and Monitoring Issues
| Service | Issue | Fix |
|---|---|---|
| Route 53 Health Checks | Not triggering | Verify endpoint availability |
| CloudWatch Alarms | Not firing | Check thresholds and metrics |
| ELB Health Checks | Instances unhealthy | Validate path and port configuration |
3. Permissions Troubleshooting
IAM permissions are one of the most common causes of issues—and a frequent exam trap.
Key Validation Checks
- Is the correct IAM role attached?
- Does the policy allow required actions?
- Is the trust relationship properly configured?
Example: CloudWatch Logging Failure
| Problem | Root Cause |
|---|---|
| EC2 not sending logs | Missing IAM permissions |
| Logs not visible | Incorrect log group ARN |
| Agent not functioning | Configuration file errors |
4. Fixing Misconfigurations
Once the issue is identified, remediation involves correcting configurations and verifying outputs.
CloudWatch Agent Troubleshooting
| Issue | Cause | Fix |
|---|---|---|
| Agent not sending logs | Agent not running | Start the agent |
| Logs missing | Incorrect config file | Update JSON configuration |
| Permission errors | Missing IAM role | Attach required permissions |
Missing Logs Troubleshooting Workflow
Follow this sequence:
- Confirm logging is enabled
- Check IAM permissions
- Validate destination (S3 or CloudWatch)
- Verify service integration
- Ensure correct region configuration
CloudTrail Troubleshooting
| Issue | Cause | Fix |
|---|---|---|
| No logs generated | Trail not enabled | Enable multi-region trail |
| Missing events | Incorrect event type | Enable data events |
| Logs missing in S3 | Bucket policy issue | Update permissions |
5. Alerting Troubleshooting
CloudWatch Alarms
| Issue | Cause | Fix |
|---|---|---|
| Alarm not triggered | Incorrect threshold | Adjust metric threshold |
| No notifications | SNS not configured | Attach SNS topic |
| Alarm inactive | No metric data | Verify metric source |
SNS Notification Issues
| Issue | Cause | Fix |
|---|---|---|
| No alerts received | Subscription not confirmed | Confirm subscription |
| Email not delivered | Spam filtering | Check spam folder |
| Lambda not triggered | Missing permissions | Add invoke permission |
6. End-to-End Troubleshooting Pipeline
Example Scenario
Problem: Alerts are not triggered for suspicious API activity
Investigation Flow
- CloudTrail → Verify logs are generated
- CloudWatch Logs → Confirm ingestion
- Metric Filter → Validate pattern matching
- Alarm → Check threshold configuration
- SNS → Confirm subscription and delivery
7. Common Troubleshooting Patterns
Pattern 1: Missing Logs
- Logging not enabled
- Incorrect region
- IAM permission issues
Pattern 2: Logs Present but No Alerts
- Metric filter misconfigured
- Alarm threshold incorrect
Pattern 3: Alerts Triggered but No Notifications
- SNS misconfiguration
- Subscription not confirmed
Pattern 4: Partial Monitoring Coverage
- Agent not deployed across all resources
- Logging not centralized in multi-account environments
8. Key Exam Tips
Tip 1: Start with Permissions
Most issues are related to IAM roles or policies.
Tip 2: Verify Logging First
If logs are not generated, detection cannot occur.
Tip 3: Validate the Full Pipeline
Always trace the flow:
CloudTrail → CloudWatch → Alarm → SNS
Tip 4: Check Region Alignment
Logs, metrics, and alarms must exist in the same region.
Tip 5: Agent-Based Logging
- Ensure agent is installed
- Validate configuration file
- Confirm IAM permissions
Tip 6: CloudWatch Alarms
- Require correct metric and threshold
- Must be connected to SNS
Tip 7: Service-Specific Logging
- Lambda → requires execution role
- API Gateway → logging must be enabled
- CloudFront → logs are delayed by design
Final Thoughts
Troubleshooting AWS security monitoring requires a systematic, end-to-end validation approach.
Focus on:
- Identifying missing or incorrect configurations
- Understanding IAM dependencies
- Tracing logs from source to alert
Key Takeaways
- If logs are missing, detection is impossible
- If alerts do not trigger, response cannot occur
