A company has a set of Amazon EC2 instances in a single private subnet of a VPC with no internet gateway. The Amazon CloudWatch agent is installed on all instances to collect logs from a specific application. To keep log traffic private, the networking team created VPC endpoints for CloudWatch (monitoring) and CloudWatch Logs and attached them to the VPC. The application is generating logs, but they are not appearing in CloudWatch. Which combination of steps should the security engineer take to troubleshoot this issue? (Choose three.)

The EC2 instance profile must have appropriate IAM permissions (e.g., logs:CreateLogStream, logs:PutLogEvents) to send logs to CloudWatch Logs. Without these permissions, the agent cannot publish logs. The CloudWatch agent configuration file (amazon-cloudwatch-agent.json) dictates which logs are collected and where they are sent; an incorrect configuration means logs won't be processed. VPC endpoint policies control access to the CloudWatch and CloudWatch Logs endpoints. If the EC2 instances are not permitted by these policies, they cannot communicate with the services. Creating a NAT gateway is unnecessary because VPC endpoints provide private connectivity. Metric filters process existing logs, they don't make logs visible or resolve collection issues. Security groups allowing EC2 instances to communicate with each other are irrelevant for sending logs to CloudWatch.