A company migrated servers to EC2 and wants to stream instance logs to Amazon CloudWatch Logs following AWS best practices. What should the SysOps administrator implement to meet this requirement?

The correct approach is to install and configure the CloudWatch agent on each EC2 instance. This agent is responsible for collecting logs and metrics and sending them to CloudWatch. Additionally, an IAM role must be attached to the EC2 instances. This role grants the necessary permissions for the CloudWatch agent to write log data to CloudWatch Logs, adhering to the principle of least privilege. The other options are incorrect because: Enabling CloudWatch from the console does not automatically install and configure agents on instances; manual agent installation is required for custom log streaming. Attaching IAM user credentials directly to instances is an anti-pattern and a security risk; IAM roles are the secure and recommended method for granting permissions to EC2 instances. Adjusting security group rules is necessary for network connectivity, but it does not grant the permissions required for the agent to interact with CloudWatch Logs; that's the role of IAM.