A multinational retail pharmaceutical company manages 120 member accounts under AWS Organizations. The security team requires all VPC Flow Logs from all member accounts to be collected and consolidated into a single central Amazon S3 bucket in a dedicated Security account. For data security compliance, all log data must be encrypted at rest using a customer managed KMS key (CMK). Which configuration should a solutions architect recommend to meet these requirements with the least administrative overhead?
- AConfigure the Amazon S3 bucket in the Security account and enable default encryption using the AWS-managed S3 key (aws/s3). Update the S3 bucket policy to allow the delivery.logs.amazonaws.com service principal to write objects. Configure VPC Flow Logs in each member account to publish to the central S3 bucket.
- BConfigure the Amazon S3 bucket in the Security account. Create a Customer Managed KMS key in the Security account. Attach IAM policies to all IAM users and roles in the member accounts that grant permission to perform s3:PutObject and use the KMS key. Configure VPC Flow Logs in each member account to publish to the central S3 bucket.
- Configure the Amazon S3 bucket in the Security account. Create a Customer Managed KMS key in the Security account with a key policy that allows the delivery.logs.amazonaws.com service principal to perform kms:GenerateDataKey* actions. Update the S3 bucket policy to allow the delivery.logs.amazonaws.com service principal to write objects. Configure VPC Flow Logs in each member account to publish to the central S3 bucket.Answer
- DConfigure the Amazon S3 bucket in the Security account. Create a Customer Managed KMS key in the Security account. Attach a Service Control Policy (SCP) at the Organization root level that allows the delivery.logs.amazonaws.com service principal to write to the central S3 bucket and access the KMS key. Configure VPC Flow Logs in each member account to publish to the central S3 bucket.
Answer
Configure the Amazon S3 bucket and a Customer Managed KMS key in the Security account, update the key policy to allow the delivery.logs.amazonaws.com service principal to perform kms:GenerateDataKey* actions, update the S3 bucket policy to allow the service principal to write objects, and configure the member VPC Flow Logs to target the central bucket.
The correct answer provides the only valid method for publishing VPC Flow Logs cross-account to an S3 bucket encrypted with a KMS key. It uses a Customer Managed Key whose policy can be modified to grant the log delivery service principal (delivery.logs.amazonaws.com) permissions to generate data keys. Simultaneously, the S3 bucket policy is configured to allow the same service principal to write objects to the bucket.
Step-by-Step Solution
Key Concept
Cross-account VPC Flow Logs delivery to an encrypted S3 bucket requires granting permissions to the Log Delivery service principal (delivery.logs.amazonaws.com) using both the S3 bucket policy and a Customer Managed KMS key policy.