A financial services firm is consolidating VPC Flow Logs from AWS accounts into a centralized Amazon S3 bucket within a dedicated Security account. The architecture must ensure that flow logs are encrypted at rest using a customer managed AWS KMS key. The Security team wants to enforce that no member account can modify or delete the flow log configurations, while ensuring log delivery succeeds across all accounts.
Which combination of configuration steps will satisfy these requirements with the least operational complexity?
- AIn the Security account, create the S3 bucket and a customer managed KMS key. Configure the S3 bucket policy to allow s3:PutObject for each member account's IAM root principal, and configure the KMS key policy to trust the member accounts. In each member account, create a cross-account IAM role with s3:PutObject permissions, and configure VPC Flow Logs to assume this IAM role to write to the S3 bucket. In the management account, apply an SCP denying ec2:DeleteFlowLogs to all member accounts.
- BIn the Security account, create the S3 bucket and enable default encryption using the AWS managed key aws/s3. Configure the S3 bucket policy to allow s3:PutObject and s3:GetBucketAcl for delivery.logs.amazonaws.com. Enable VPC Flow Logs in the member accounts pointing to the Security account S3 bucket. In the management account, apply an SCP denying ec2:DeleteFlowLogs to all member accounts.
- In the Security account, create the S3 bucket and a customer managed KMS key. Configure the S3 bucket policy to allow s3:PutObject and s3:GetBucketAcl for delivery.logs.amazonaws.com, and configure the KMS key policy to allow delivery.logs.amazonaws.com to perform kms:GenerateDataKey* and kms:Decrypt. Enable VPC Flow Logs in the member accounts pointing to the Security account S3 bucket, specifying the KMS key ARN. In the management account, apply an SCP denying ec2:DeleteFlowLogs to all member accounts.Answer
- DIn the Security account, create the S3 bucket and a customer managed KMS key. Configure the S3 bucket policy and KMS key policy to allow access to delivery.logs.amazonaws.com. Enable VPC Flow Logs in the member accounts. In the management account, apply an SCP that explicitly allows ec2:CreateFlowLogs and ec2:DescribeFlowLogs while denying ec2:DeleteFlowLogs to member accounts, relying on the SCP to grant the necessary permissions to create the flow logs.
Answer
In the Security account, create the S3 bucket and a customer managed KMS key. Configure the S3 bucket policy to allow s3:PutObject and s3:GetBucketAcl for delivery.logs.amazonaws.com, and configure the KMS key policy to allow delivery.logs.amazonaws.com to perform kms:GenerateDataKey* and kms:Decrypt. Enable VPC Flow Logs in the member accounts pointing to the Security account S3 bucket, specifying the KMS key ARN. In the management account, apply an SCP denying ec2:DeleteFlowLogs to all member accounts.
The correct solution uses a customer managed KMS key to support cross-account resource sharing, which is required because AWS managed keys (such as aws/s3) cannot be shared across accounts. It configures both the S3 bucket policy and the KMS key policy to permit the Log Delivery service principal (delivery.logs.amazonaws.com), which is the principal responsible for writing VPC Flow Logs. Additionally, it implements an SCP with a deny effect to prevent member accounts from modifying or deleting flow logs, without mistakenly relying on the SCP to grant permissions.
Step-by-Step Solution
Key Concept
Cross-Account VPC Flow Logs with KMS Encryption and SCP Guardrails