Examkin

Question

Difficulty: Very hardCentralized Monitoring, Logging, and Auditing Solutions

An enterprise is designing a centralized compliance and auditing architecture using AWS Organizations. The organization consists of a management account, a dedicated Logging account, and multiple member accounts. A solutions architect must configure a single AWS CloudTrail trail at the organization level that automatically aggregates log files from all current and future member accounts into an Amazon S3 bucket located in the Logging account.

The architecture must enforce the following security requirements:
- All log files stored in the S3 bucket must be encrypted at rest using a customer managed key (CMK) in AWS KMS that is managed by the Logging account.
- The member accounts must have no ability to read, decrypt, or delete the aggregated logs.
- The Logging account's security team must have exclusive permission to decrypt and analyze the logs.
- The solution must ensure that log delivery is secure and follows the principle of least privilege.

Which TWO configuration steps should the solutions architect perform to meet these requirements?

  1. Configure a key policy for the customer managed key in the Logging account that grants `kms:GenerateDataKey*` and `kms:DescribeKey` permissions to the `cloudtrail.amazonaws.com` service principal with a condition restricting `aws:SourceArn` to the Organization Trail ARN, and restrict `kms:Decrypt` permissions to authorized security roles in the Logging account.Answer
  2. Configure an S3 bucket policy on the destination bucket in the Logging account that grants `s3:PutObject` and `s3:GetBucketAcl` permissions to the `cloudtrail.amazonaws.com` service principal, requiring the `s3:x-amz-acl` header to be set to `bucket-owner-full-control`, and restricting the S3 resource path to `AWSLogs/o-orgid/*` where `o-orgid` is the organization ID.Answer
  3. C
    Enable S3 default encryption on the destination bucket using the AWS managed key `aws/s3` in the Logging account, and configure the S3 bucket policy to allow the AWS Organizations management account and all member accounts to perform `kms:Decrypt` and `kms:GenerateDataKey` operations.
  4. D
    Apply a Service Control Policy (SCP) at the root level of the organization that explicitly grants `s3:PutObject` and `kms:GenerateDataKey` permissions to the `cloudtrail.amazonaws.com` service principal for the centralized bucket and KMS key, eliminating the need for resource-based policies.
  5. E
    Configure the S3 bucket policy in the Logging account to allow the IAM roles of all member accounts in the organization to perform `s3:PutObject` and `s3:GetBucketAcl` on the bucket, ensuring that local member account processes can deliver the logs.

Answer

Configure a key policy for the customer managed key in the Logging account that allows the CloudTrail service principal to generate data keys under the trail's context while restricting decryption to authorized roles in the Logging account, and configure an S3 bucket policy on the destination bucket that permits the CloudTrail service principal to write log objects using the bucket-owner-full-control ACL constraint under the organization's logs prefix.
To centralize CloudTrail logs across an organization using a customer managed KMS key, the key policy in the Logging account must permit the CloudTrail service principal to generate data keys and describe the key under the trail's context. At the same time, the S3 bucket policy in the Logging account must authorize the CloudTrail service principal to write objects under the organization prefix and read bucket ACLs, ensuring log delivery succeeds while maintaining least privilege.

Step-by-Step Solution

1
Analyze AWS CloudTrail cross-account logging requirements.
Identify that CloudTrail delivers logs using the service principal `cloudtrail.amazonaws.com` rather than local IAM roles.
This establishes that the destination S3 bucket and KMS key policies must trust the CloudTrail service principal, not individual member account principals.
2
Determine the encryption key requirements.
Conclude that a Customer Managed Key (CMK) is required because AWS-managed keys cannot be shared across accounts or have their policies customized.
The KMS key policy must explicitly allow the CloudTrail service principal to perform `kms:GenerateDataKey*` and `kms:DescribeKey` operations for cross-account log delivery.
3
Formulate the S3 bucket policy.
Define an S3 bucket policy that permits `s3:PutObject` and `s3:GetBucketAcl` for the CloudTrail service principal with constraints on the Organization ID prefix and the `bucket-owner-full-control` ACL.
This ensures that CloudTrail has permissions to deliver logs to the bucket while giving the Logging account full ownership of the written files.
4
Define the decryption access control.
Ensure the KMS key policy does not grant `kms:Decrypt` to the CloudTrail service principal or the member accounts, restricting it only to security roles in the Logging account.
This guarantees that member accounts can write encrypted logs but cannot decrypt or read them once they are stored.

Key Concept

Centralized cross-account logging configuration using AWS Organizations, S3 bucket policies, and KMS key policies.
Estimated Time:3m 0s
Rate this question

Topics

Centralized Monitoring, Logging, and Auditing Solutions

More questions from this topic