Examkin

Question

Difficulty: EasyCentralized Monitoring, Logging, and Auditing Solutions

An organization has multiple member accounts managed under AWS Organizations. The security team wants to enable a single AWS CloudTrail trail that automatically collects API activity logs across all current and future member accounts, delivering them to a centralized Amazon S3 bucket located in a dedicated Security account. Which configuration steps must a solutions architect perform to implement this centralized logging solution?

  1. A
    Create an organization trail from the management account. Enable S3 server-side encryption on the destination S3 bucket using the AWS-managed KMS key (aws/s3) to ensure all member account logs are encrypted.
  2. B
    Create a separate CloudTrail trail in each member account. Apply a Service Control Policy (SCP) at the Organization root that grants the s3:PutObject permission to all member accounts to allow delivery to the centralized S3 bucket.
  3. Create an organization trail from the management account or a delegated administrator account. Configure the S3 bucket policy in the Security account to allow the CloudTrail service principal (cloudtrail.amazonaws.com) to write logs, using a condition that restricts access to the organization's ID.Answer
  4. D
    Create an organization trail from the management account. Configure the destination S3 bucket policy in the Security account to grant s3:PutObject permissions exclusively to the AWS account ID of the management account.

Answer

Create an organization trail from the management account or a delegated administrator account. Configure the S3 bucket policy in the Security account to allow the CloudTrail service principal (cloudtrail.amazonaws.com) to write logs, using a condition that restricts access to the organization's ID.
To centralize CloudTrail logs across an AWS Organization, an organization trail should be created in the management account or a delegated administrator account. The destination S3 bucket policy in the central Security account must trust the CloudTrail service principal (cloudtrail.amazonaws.com) and permit it to perform s3:PutObject operations. Restricting the write access to the specific Organization ID using the aws:PrincipalOrgID condition ensures that only trails from within the organization can write to the bucket.

Step-by-Step Solution

1
Configure the destination S3 bucket policy in the central Security account.
The bucket policy allows the cloudtrail.amazonaws.com service principal to write objects (s3:PutObject), using the aws:PrincipalOrgID condition to restrict access to the organization.
This establishes the cross-account permission boundary required for the CloudTrail service to write logs from any account within the organization to the central bucket.
2
Deploy the trail as an organization trail in the management account or a delegated administrator account.
The trail is automatically created in all member accounts, and any future accounts added to the organization will also have the trail applied.
Creating the trail at the organization level simplifies governance and ensures centralized auditing without manual trail creation in each individual account.

Key Concept

Centralized Organization Trail Delivery to S3
Rate this question

Topics

Centralized Monitoring, Logging, and Auditing Solutions

More questions from this topic