The CloudWatch agent is running on a university's EC2 instances and its config lists the memory metric. The agent log reports AccessDenied for PutMetricData, and no memory datapoints arrive. Which change fixes the publish failure?
Select an answer to reveal the explanation.
Short Explanation
The agent is knocking, and CloudWatch is checking the guest list. AccessDenied on PutMetricData means the instance role lacks permission, so you need an instance profile that allows the call and then restart the agent. Opening SSH does not fix the publishing failure.
Full Explanation
PutMetricData is the API the CloudWatch agent uses to publish metrics. An AccessDenied entry in the agent log means IAM rejected that call, so attach an instance profile that allows cloudwatch:PutMetricData, such as one with the CloudWatch agent server policy, and restart the agent. Opening security group port 22 from anywhere only permits SSH access; it does not change the authorization for the API call the agent is making. Turning on CloudTrail data events records selected data-plane calls but does not grant permission to publish metrics. Enabling S3 versioning on the log archive bucket protects objects there and has nothing to do with this denial. Caveat: if the agent uses a named credentials file or a different Region from the one in its config, that mismatch may also need fixing, but the logged error here is the denial. Operational check: confirm the instance profile is attached, use the IAM policy simulator to check cloudwatch:PutMetricData as that role, and verify that a new memory datapoint appears after the agent restarts.