Examkin

Question

Difficulty: MediumCentralized Monitoring, Logging, and Auditing Solutions

A logistics company manages 120120 member accounts within an AWS Organization. The security team is setting up an organization-wide AWS CloudTrail trail to log all API activity to a centralized Amazon S3 bucket in a dedicated Logging account. The requirements state that all logs must be encrypted using an AWS KMS Customer Managed Key (CMK) and that access must follow the principle of least privilege. Which TWO configuration steps are required to achieve this goal?

  1. Configure the S3 bucket policy in the Logging account to grant write permissions (s3:PutObject) to the AWS CloudTrail service principal (cloudtrail.amazonaws.com) for all log paths, with a condition matching the organization's ID using aws:PrincipalOrgID.Answer
  2. Create a customer managed key (CMK) in the Logging account, and configure its key policy to allow the CloudTrail service principal (cloudtrail.amazonaws.com) to perform kms:GenerateDataKey* and kms:DescribeKey operations, with a condition matching the organization's ID using aws:PrincipalOrgID.Answer
  3. C
    Enable encryption on the organization trail using the AWS-managed KMS key (aws/s3) in the Logging account to encrypt the logs before they are written to the S3 bucket.
  4. D
    Attach a Service Control Policy (SCP) to the organization's root that allows member accounts to use the s3:PutObject action on the centralized S3 bucket in the Logging account.
  5. E
    Configure the S3 bucket policy in the Logging account to grant write permissions (s3:PutObject) to the Amazon S3 service principal (s3.amazonaws.com) for all log paths, specifying the AWS Organization ID as the principal.

Answer

Configure the S3 bucket policy to grant write access to the CloudTrail service principal with a condition for the AWS Organization ID, and create a customer managed key (CMK) in the Logging account with a key policy allowing the CloudTrail service principal to generate data keys and describe the key, constrained by the Organization ID.
Centralizing CloudTrail logs in a multi-account setup requires configured bucket and key policies that allow the CloudTrail service principal (cloudtrail.amazonaws.com) to access resources in the Logging account. To ensure that only member accounts within the specific AWS Organization can deliver logs, the aws:PrincipalOrgID condition is used. S3-managed and AWS-managed KMS keys cannot be shared across accounts for CloudTrail logging, so a Customer Managed Key (CMK) must be created and configured with a key policy that delegates kms:GenerateDataKey* and kms:DescribeKey permissions to CloudTrail.

Step-by-Step Solution

1
Set up the centralized S3 bucket policy.
The S3 bucket in the dedicated Logging account is configured to accept log delivery from the CloudTrail service principal across all accounts in the organization by using the aws:PrincipalOrgID condition.
CloudTrail is a service principal that writes logs to the bucket on behalf of the member accounts, so S3 bucket permissions must be granted to the service principal with organizational boundaries.
2
Configure the KMS customer managed key key policy.
A Customer Managed Key (CMK) is created with a key policy allowing cloudtrail.amazonaws.com to generate data keys and describe the key, restricted to the organization's accounts using the aws:PrincipalOrgID condition key.
AWS-managed keys cannot be shared cross-account, so a CMK is required. The key policy must allow CloudTrail to encrypt logs as they are written from any account in the organization.

Key Concept

Centralizing AWS CloudTrail logs in a multi-account environment requires delegating S3 write permissions and KMS decryption/encryption permissions to the CloudTrail service principal with organization-level scoping using the aws:PrincipalOrgID condition.
Estimated Time:2m 0s
Rate this question

Topics

Centralized Monitoring, Logging, and Auditing Solutions

More questions from this topic