Examkin

Question

Difficulty: Very hardCentralized Monitoring, Logging, and Auditing Solutions

A global software-as-a-service (SaaS) provider operates a multi-account environment within AWS Organizations consisting of 8080 member accounts. The security compliance mandate requires that all AWS CloudTrail management events across all accounts and Regions be consolidated into a single Amazon S3 bucket located in a dedicated Security account. The logs must be encrypted at rest using a Customer Managed Key (CMK) in AWS KMS. Security analysts in the Security account must be able to review these logs, but member accounts must have no access to read or modify them. The solution must minimize operational overhead, prevent member accounts from disabling the logging configuration, and ensure log integrity. Which TWO configuration steps must the Solutions Architect implement to meet these requirements?

  1. Create an organization trail in the Organizations management account that targets the S3 bucket in the Security account. Configure a bucket policy on the Security S3 bucket that grants 's3:PutObject' and 's3:GetBucketLocation' permissions to the CloudTrail service principal, restricted by a condition matching the AWS Organization ID.Answer
  2. Create a Customer Managed Key (CMK) in the Security account. Configure its key policy to grant 'kms:GenerateDataKey*' and 'kms:DescribeKey' permissions to the CloudTrail service principal, restricted by a condition matching the organization trail ARN, and grant 'kms:Decrypt' permissions to the Security account analysts' role.Answer
  3. C
    Configure S3 default encryption on the Security S3 bucket using the AWS-managed key 'aws/s3', and apply a Service Control Policy (SCP) at the Organization root that grants member accounts permissions to write to this key.
  4. D
    Configure the S3 bucket policy in the Security account to grant write access to the IAM roles of all administrators in the member accounts, and require each member account to manually configure a trail pointing to the Security account S3 bucket.
  5. E
    Deploy a Service Control Policy (SCP) at the root of the AWS Organization that permits the 's3:PutObject' action on the Security account's S3 bucket, and configure the member accounts' local trails to encrypt logs using the default AWS-managed KMS key 'aws/cloudtrail'.

Answer

Create an organization trail in the Organizations management account targeting the Security account S3 bucket, with a bucket policy permitting the CloudTrail service principal under the organization ID condition. Additionally, create a Customer Managed Key (CMK) in the Security account with a key policy allowing the CloudTrail service principal to generate data keys and describe the key, and allowing the analysts' role to decrypt.
The correct solution involves creating an organization trail in the management account to automatically aggregate logs across all accounts and Regions, coupled with a bucket policy in the Security account that allows the CloudTrail service principal to deliver logs using the organization ID condition. Additionally, a Customer Managed Key (CMK) must be created in the Security account with a key policy that allows the CloudTrail service principal to perform data key generation and key description, restricted to the trail's ARN, while granting decrypt permissions to the security analysts' IAM role.

Step-by-Step Solution

1
Configure the S3 bucket in the Security account with a bucket policy allowing the CloudTrail service principal to write objects.
The bucket policy allows 's3:PutObject' and 's3:GetBucketLocation' for 'cloudtrail.amazonaws.com' under the condition 'aws:PrincipalOrgID' matching the organization's ID.
This enables secure log delivery from any account within the organization to the central S3 bucket.
2
Create a Customer Managed Key (CMK) in the Security account and configure its key policy.
The CMK key policy allows 'kms:GenerateDataKey*' and 'kms:DescribeKey' for 'cloudtrail.amazonaws.com', constrained by the trail's source ARN, and allows 'kms:Decrypt' for the security analysts.
CloudTrail requires these permissions on the customer managed key to perform envelope encryption across the organization's accounts, and analysts need decrypt permissions to view the logs.
3
Create the Organization Trail in the management account pointing to the Security account S3 bucket and KMS CMK.
The trail automatically deploys across all member accounts and Regions, sending logs to the central bucket and encrypting them with the CMK.
This guarantees uniform logging coverage, reduces management overhead, and prevents member account admins from altering or disabling the trail.

Key Concept

Centralized multi-account logging with cross-account KMS encryption and S3 bucket policies using organization constraints.
Rate this question

Topics

Centralized Monitoring, Logging, and Auditing Solutions

More questions from this topic