Examkin

Question

Difficulty: MediumMulti-Account Governance and Organizational Structure

A logistics company is designing its AWS multi-account environment using AWS Organizations. The compliance team mandates that all AWS CloudTrail logs from all current and future member accounts must be securely consolidated into a single Amazon S3 bucket within a dedicated Log Archive account. Additionally, these logs must be encrypted using AWS KMS keys, and member account administrators must be prevented from disabling or altering any trail configuration. Which of the following solutions meets these security and compliance requirements with the lowest administrative effort?

  1. Deploy an organization trail from the management account that logs all events and delivers them to a central S3 bucket in the Log Archive account. Configure the S3 bucket policy and a KMS customer managed key policy in the Log Archive account to grant write permissions to the CloudTrail service principal, restricted by the organization ID. Attach a Service Control Policy (SCP) at the organization root that denies member accounts the ability to stop, delete, or update any CloudTrail configuration.Answer
  2. B
    Deploy an organization trail from the management account that logs all events and delivers them to a central S3 bucket in the Log Archive account. Configure the S3 bucket policy to grant write permissions to the CloudTrail service principal, restricted by the organization ID, and encrypt the bucket using the default AWS managed S3 key (aws/s3). Attach a Service Control Policy (SCP) at the organization root that denies member accounts the ability to stop, delete, or update any CloudTrail configuration.
  3. C
    Use an Infrastructure as Code (IaC) pipeline to deploy a local CloudTrail trail in each member account that writes to a central S3 bucket in the Log Archive account. Configure the S3 bucket policy to allow the CloudTrail service principal to write logs, specifying each member account ID. Encrypt the logs using a KMS customer managed key. Attach a customer-managed IAM policy to all administrator roles in the member accounts that denies permissions for all CloudTrail actions.
  4. D
    Deploy an organization trail from the management account that logs all events and delivers them to a central S3 bucket in the Log Archive account. Configure a KMS customer managed key policy in the Log Archive account to grant permissions to the CloudTrail service principal. Do not configure a resource-based bucket policy on the S3 bucket; instead, rely on an IAM role trust policy in the management account to grant cross-account write permissions to the bucket.

Answer

Deploy an organization trail from the management account that logs all events and delivers them to a central S3 bucket in the Log Archive account. Configure the S3 bucket policy and a KMS customer managed key policy in the Log Archive account to grant write permissions to the CloudTrail service principal, restricted by the organization ID. Attach a Service Control Policy (SCP) at the organization root that denies member accounts the ability to stop, delete, or update any CloudTrail configuration.
Deploying an organization trail from the management account automatically captures events from all current and future accounts, sending them to a centralized S3 bucket. A customer managed KMS key is required because AWS managed keys (such as aws/s3) cannot be shared across accounts or customized with policy statements to allow cross-account service access. The S3 bucket policy and KMS key policy must authorize the CloudTrail service principal with the organization ID condition. Lastly, a Service Control Policy (SCP) applied at the organization root effectively restricts member account administrators from altering or disabling the trail configuration, regardless of their local IAM permissions.

Step-by-Step Solution

1
Configure the centralized storage in the Log Archive account.
An S3 bucket is created with a bucket policy allowing the CloudTrail service principal (cloudtrail.amazonaws.com) to write logs, restricted by the aws:PrincipalOrgID condition.
This guarantees that only accounts within the AWS Organization can write logs to this central location.
2
Configure the encryption key in the Log Archive account.
A customer managed AWS KMS key is created with a key policy allowing CloudTrail to generate data keys and decrypt, restricted by the organization ID.
AWS managed keys cannot be shared cross-account, so a Customer Managed Key is required to enable member accounts to write encrypted logs to the centralized bucket.
3
Deploy the trail organization-wide.
An organization trail is created from the management account, which automatically deploys and manages logging across all current and future member accounts.
This ensures complete coverage and reduces administrative overhead compared to manually deploying trails.
4
Enforce governance using Service Control Policies (SCPs).
An SCP is attached to the organization root that denies permissions for stopping, deleting, or updating trails in member accounts.
This prevents administrators in member accounts from tampering with the logging configuration, regardless of their local IAM permissions.

Key Concept

Organization Trails, Customer Managed KMS Keys, and SCP Guardrails
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic