Examkin

Question

Difficulty: MediumCentralized Monitoring, Logging, and Auditing Solutions

A financial services company is designing a centralized logging architecture for its AWS environment. The environment consists of 7575 member accounts organized under AWS Organizations. The company has designated a dedicated Security Operations account for managing security tools and a separate Log Archive account for long-term log storage. The Solutions Architect must configure AWS CloudTrail to capture all management events across all accounts. The logs must be consolidated in a single Amazon S3 bucket in the Log Archive account, encrypted with a Customer Managed Key (CMK) in AWS KMS, and managed from the Security Operations account.

Which TWO actions must the Solutions Architect take to configure this solution?

  1. From the organization's management account, register the Security Operations account as a delegated administrator for CloudTrail. In the Security Operations account, create an organization trail configured to send logs to the S3 bucket in the Log Archive account.Answer
  2. Configure the key policy of the Customer Managed Key (CMK) in the Log Archive account to allow the `cloudtrail.amazonaws.com` service principal to perform `kms:GenerateDataKey*` and `kms:Decrypt` operations, restricting access using the `aws:PrincipalOrgID` condition.Answer
  3. C
    Configure the S3 bucket policy in the Log Archive account to grant `s3:PutObject` permissions directly to the IAM roles of the member accounts to enable cross-account log delivery.
  4. D
    Configure the organization trail to use the default AWS-managed KMS key (`aws/s3`) in the Log Archive account to encrypt the logs.
  5. E
    Attach a Service Control Policy (SCP) to the root of the organization that grants the `s3:PutObject` permission on the destination bucket to all member accounts.

Answer

Register the Security Operations account as a delegated administrator from the management account to create the organization trail, and configure the key policy of the Customer Managed Key (CMK) in the Log Archive account to grant necessary permissions to the CloudTrail service principal with an organization condition.
To centralize log management under the Security Operations account, it must be registered as a delegated administrator for AWS CloudTrail from the management account. This allows the security team to define the organization trail. When encrypting consolidated logs across multiple accounts with a Customer Managed Key (CMK), the key policy must explicitly allow the CloudTrail service principal (`cloudtrail.amazonaws.com`) to generate data keys and decrypt logs, which can be secured using the `aws:PrincipalOrgID` condition to ensure only trails within the organization can utilize the key.

Step-by-Step Solution

1
Register the Security Operations account as a delegated administrator from the management account.
The Security Operations account gains administrative privileges to create and manage organization-level trails.
To centralize security operations, administrative tasks should be delegated out of the management account.
2
Create an organization trail from the newly registered Security Operations account, directing the output to the centralized S3 bucket.
CloudTrail automatically initiates log collection from all 7575 member accounts in the organization.
This establishes centralized logging without requiring individual manual trail setups in each member account.
3
Configure the KMS key policy for the Customer Managed Key in the Log Archive account.
The CloudTrail service principal is granted permissions to generate data keys and decrypt logs for all accounts belonging to the organization.
A Customer Managed Key (CMK) is required because AWS-managed keys cannot be shared for cross-account log delivery.

Key Concept

Delegated administration for AWS CloudTrail and cross-account KMS encryption key policies in a multi-account organization.
Rate this question

Topics

Centralized Monitoring, Logging, and Auditing Solutions

More questions from this topic