Examkin

Question

Difficulty: MediumCentralized Monitoring, Logging, and Auditing Solutions

A financial services firm utilizes AWS Organizations to manage 70 member accounts. A Solutions Architect is designing a centralized logging solution where AWS CloudTrail trails in all member accounts must deliver log files to a single Amazon S3 bucket in a dedicated Logging account. To comply with security mandates, all log files must be encrypted using an AWS KMS Customer Managed Key (CMK). Which configuration must the Solutions Architect implement to meet these requirements?

  1. Create the S3 bucket and the KMS CMK in the Logging account. Configure the S3 bucket policy to allow the CloudTrail service principal (cloudtrail.amazonaws.com) to write logs, using the aws:PrincipalOrgID condition. Configure the KMS CMK policy to allow the CloudTrail service principal to perform GenerateDataKey* and DescribeKey operations, using the same aws:PrincipalOrgID condition.Answer
  2. B
    Create the S3 bucket in the Logging account and enable default encryption using the AWS-managed KMS key aws/s3. Configure the S3 bucket policy to allow the CloudTrail service principal (cloudtrail.amazonaws.com) to write logs, and configure an IAM policy in the member accounts to allow the CloudTrail service to use the AWS-managed key.
  3. C
    Create the S3 bucket and the KMS CMK in the Logging account. Configure the S3 bucket policy to allow the root user of each member account to perform PutObject operations. Configure the trails in the member accounts to assume a cross-account IAM role in the Logging account to deliver logs and access the KMS CMK.
  4. D
    Create the S3 bucket and the KMS CMK in the Logging account. Attach a Service Control Policy (SCP) at the root of the AWS Organization that allows the s3:PutObject and kms:GenerateDataKey* actions on the logging S3 bucket and KMS CMK for all member accounts, allowing log delivery without modifying the resource policies in the Logging account.

Answer

Create the S3 bucket and the Customer Managed Key (CMK) in the Logging account. Configure the S3 bucket policy and the KMS CMK policy to grant write and key generation permissions to the CloudTrail service principal, restricting access to the organization using the aws:PrincipalOrgID condition.
The correct answer configuration sets up resource-based policies on both the S3 bucket and the Customer Managed Key (CMK) in the target Logging account to grant the AWS CloudTrail service principal access. Because CloudTrail operates as a service principal (cloudtrail.amazonaws.com) rather than a specific IAM role when delivering logs, the bucket policy and key policy must directly trust this service principal. Scoping the permissions to the organization using the aws:PrincipalOrgID condition ensures that only trails within the organization can write to the bucket and use the key, maintaining security without manual cross-account role configurations.

Step-by-Step Solution

1
Determine log delivery identity.
CloudTrail delivers logs as a service principal (cloudtrail.amazonaws.com) rather than assuming cross-account IAM roles.
This dictates that permissions must be granted directly to the service principal in the target resource-based policies.
2
Select encryption key type.
Choose a Customer Managed Key (CMK) instead of an AWS-managed key.
AWS-managed keys (like aws/s3) cannot be shared across accounts or customized to allow access from other accounts' CloudTrail services.
3
Configure the S3 bucket policy and KMS key policy.
Add policies allowing cloudtrail.amazonaws.com to perform s3:PutObject and kms:GenerateDataKey*.
These are the minimum necessary permissions required by CloudTrail to write encrypted logs to the S3 bucket.
4
Implement organizational filtering.
Add the aws:PrincipalOrgID condition matching the Organization ID to both policies.
This restricts log delivery and key usage strictly to the member accounts of the specific AWS Organization.

Key Concept

Cross-account AWS CloudTrail logging requires utilizing Customer Managed Keys (CMKs) and configuring resource-based policies (S3 bucket policy and KMS key policy) to trust the CloudTrail service principal, scoped with the aws:PrincipalOrgID condition.
Estimated Time:2m 0s
Rate this question

Topics

Centralized Monitoring, Logging, and Auditing Solutions

More questions from this topic