An enterprise is designing a centralized compliance auditing and logging architecture across more than 100 AWS accounts managed under AWS Organizations. A solutions architect is setting up an organization-wide trail in the management account to deliver AWS CloudTrail logs to a centralized Amazon S3 bucket located in a dedicated Log Archive account. The security team requires all log files to be encrypted at rest using a Key Management Service (KMS) key. Member accounts must not be able to decrypt logs from other accounts, and all log delivery must be securely restricted to the organization. Which of the following configurations must the solutions architect implement to meet these requirements? (Select TWO.)
- Create a customer managed key in AWS KMS in the Log Archive account. Configure the key policy to grant the cloudtrail.amazonaws.com service principal kms:GenerateDataKey* and kms:DescribeKey permissions, using a condition that restricts access to the organization's trails.Answer
- Configure the S3 bucket policy in the Log Archive account to grant the cloudtrail.amazonaws.com service principal s3:PutObject and s3:GetBucketAcl` permissions, restricting the s3:PutObject resource path to the organization's path structure and enforcing the bucket-owner-full-control ACL.Answer
- CEnable default encryption on the S3 bucket in the Log Archive account using the AWS-managed KMS key (aws/s3), and configure the organization-wide CloudTrail to use this key to encrypt all log files during transit.
- DAttach a Service Control Policy (SCP) at the organization Root that explicitly allows the cloudtrail.amazonaws.com service principal to perform s3:PutObject and kms:GenerateDataKey* actions across all member accounts.
- EConfigure the S3 bucket policy in the Log Archive account to grant s3:PutObject permissions to the IAM administrator roles in the member accounts, allowing them to assume a cross-account role to deliver the logs.
Answer
To secure centralized multi-account CloudTrail logging, create a customer managed key in the Log Archive account and configure its key policy to grant the CloudTrail service principal the necessary permissions to generate data keys. Additionally, configure the S3 bucket policy in the Log Archive account to grant the CloudTrail service principal permissions to write objects under the organization's path prefix while enforcing the bucket-owner-full-control access control list.
Implementing a centralized, encrypted logging architecture requires a Customer Managed Key (CMK) in the Log Archive account with a key policy allowing the CloudTrail service principal to generate data keys. Simultaneously, the S3 bucket policy in the Log Archive account must grant the CloudTrail service principal permissions to read the bucket ACL and write logs into the organization-specific prefix (AWSLogs/o-orgid/*) using the bucket-owner-full-control ACL to ensure log files remain owned by the Log Archive account.
Step-by-Step Solution
Key Concept
Cross-account centralized logging using AWS Organizations, AWS CloudTrail, Amazon S3 bucket policies, and AWS KMS Customer Managed Keys.