How Should Auto Scaling Applications Preserve Logs for One Year?
A company is running an application on Amazon EC2 instances in an Auto Scaling group. The application stores logs locally. A security engineer noticed that logs were lost after a scale-in event. The security engineer needs to recommend a solution to ensure the durability and availability of log data. All logs must be kept for a minimum of 1 year for auditing purposes. What should the security engineer recommend?
Community Insight
This question tests durable centralized logging versus instance-bound storage; the trap is choosing EFS or EBS because it sounds persistent while overlooking whether logs are continuously shipped before termination.
Local logs on Auto Scaling EC2 instances disappear when scale-in terminates an instance. The durable solution is to stream logs with the CloudWatch agent to CloudWatch Logs and set a one-year retention policy.
A common wrong choice is EFS with a daily copy from the instance EBS volume, because EFS is durable but the once-a-day copy leaves up to a day of logs on an instance that can be terminated during scale-in.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option C addresses the root cause: logs are moved continuously off the instance instead of relying on local storage surviving an Auto Scaling event. The CloudWatch agent can be baked into the AMI or supplied through the launch template, and it ships application logs to CloudWatch Logs, which is durable and independent of any single EC2 instance. CloudWatch Logs retention is configured per log group, so the security team can set a retention period of at least one year for auditing. This satisfies both durability and availability while keeping the logs centrally reviewable.Why the Other Options Are Wrong
Option A creates an EBS log volume per instance and reattaches it after termination, but EBS is Availability Zone-bound and the process is manual, so it does not provide a reliable centralized log archive. Option B uses EFS, which is durable and shared, but the application still writes locally first and the copy runs only once a day, so scale-in can still destroy up to a day of logs. Option D only pauses termination for one hour with a lifecycle hook and SNS notification, which depends on manual review and does not retain logs for the required year. None of these options guarantees that every log record survives an Auto Scaling scale-in event.Community Comment Notes
All visible learner comments selected option C. As 7f6aef3 framed it, the solution fixes the root cause by continuously sending logs off-instance to durable storage with configurable one-year retention. Gonzales summarized the same reasoning with the phrase "Push logs continuously off-instance" and noted that Auto Scaling becomes safe when logs do not depend on instance lifetime. Bigdata2ml added the useful retention detail that "By default, log data is stored in CloudWatch Logs indefinitely" but retention can be configured per log group, which is exactly how the one-year audit requirement is met.Official Reference
Exam Strategy
When a question mentions logs disappearing at scale-in and a fixed retention period, prefer continuous shipment to a managed logging service with configurable retention over lifecycle hooks or block storage workarounds. Check whether the proposed fix moves every log record off-instance before termination, not just once a day or after a manual review window.
Frequently Asked Questions
Why doesn't EFS with a daily log copy meet the durability requirement?
The application still writes to local EBS first, so a scale-in before the daily copy loses up to a day of logs. EFS is durable, but the copy process is not continuous.
Can CloudWatch Logs retention be set to one year?
Yes. CloudWatch Logs retention is configured per log group, and you can set it to 365 days or another period that satisfies the audit requirement.
Related Analysis
Practice All SCS-C03 Questions
Access 86 questions with complete answers and detailed explanations.
View Full SCS-C03 Practice Test →