Examkin

Question

Difficulty: HardEnhancing Data Protection and Compliance

A healthcare software provider is reviewing its centralized logging architecture in AWS. Currently, AWS CloudTrail logs from multiple member accounts in an AWS Organization are consolidated into an Amazon S3 bucket located in a dedicated Security account. The S3 bucket is configured with default encryption using the AWS managed key aws/s3.

To meet new regulatory compliance requirements, the solutions architect must enhance data protection. The requirements specify:
1. All log data must be encrypted at rest using a customer-managed key with automatic annual rotation.
2. Spoke accounts must be able to write their CloudTrail logs to the destination S3 bucket.
3. Cross-account access to the KMS key and S3 bucket must be restricted to the minimum required permissions.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

  1. Create a customer managed KMS key in the Security account with automatic key rotation enabled. Update the key policy to grant the AWS CloudTrail service principal permissions for the kms:GenerateDataKey* and kms:Decrypt actions, restricted using the aws:PrincipalOrgID condition.Answer
  2. Update the S3 bucket policy in the Security account to grant the AWS CloudTrail service principal permissions for the s3:PutObject and s3:GetBucketAcl actions, restricted using the aws:PrincipalOrgID condition.Answer
  3. C
    Modify the default S3 bucket encryption to use the AWS managed key aws/s3 and update the key policy via the AWS CLI to delegate cross-account access to the member accounts.
  4. D
    Create a Service Control Policy (SCP) at the Organization root that grants the cloudtrail.amazonaws.com service principal permissions to perform kms:GenerateDataKey* on the aws/s3 managed key across all member accounts.
  5. E
    Update the S3 bucket policy in the Security account to grant the wildcard principal ("Principal": "*") full s3:* permissions, and use IAM policies in each member account to restrict write access to their respective CloudTrail service roles.

Answer

Create a customer managed KMS key in the Security account with automatic rotation enabled, updating its policy to grant the CloudTrail service principal permissions to generate data keys and decrypt under the organization ID condition. Additionally, update the destination S3 bucket policy to allow the CloudTrail service principal to put objects and read bucket ACLs, restricted to the organization ID.
The correct combination implements a customer managed KMS key in the Security account with rotation enabled, allowing the customization of the key policy to authorize the AWS CloudTrail service principal. In addition, the S3 bucket policy must be updated to permit the CloudTrail service principal to write objects. Both policies must enforce organizational boundaries using the aws:PrincipalOrgID condition to restrict access to trusted member accounts.

Step-by-Step Solution

1
Establish Key Management Architecture
Create a Customer Managed Key (CMK) in the Security account with automatic annual rotation enabled.
AWS-managed keys (like aws/s3) cannot be shared across accounts or have their policies customized, making a customer-managed key necessary for cross-account CloudTrail encryption.
2
Configure Key Policy for Cross-Account Access
Grant the cloudtrail.amazonaws.com service principal permission to perform kms:GenerateDataKey* and kms:Decrypt, adding a condition matching the organization ID.
This allows the CloudTrail service running in the spoke accounts to generate data keys for encrypting logs before writing them to the destination S3 bucket, while preventing unauthorized accounts from utilizing the key.
3
Configure Destination S3 Bucket Policy
Modify the S3 bucket policy to allow cloudtrail.amazonaws.com to execute s3:PutObject and s3:GetBucketAcl actions, limited via the aws:PrincipalOrgID condition.
S3 bucket policies must explicitly trust the CloudTrail service principal from the organization accounts to enable secure, cross-account log delivery.

Key Concept

Centralized cross-account logging requires modifying both the target S3 bucket policy and a customer-managed KMS key policy to permit the CloudTrail service principal to write and encrypt objects, restricted by organizational boundaries.

Alternative Method

Instead of using aws:PrincipalOrgID, you can restrict the bucket and KMS key policies using conditions like aws:SourceArn to specify only particular trail ARNs, or aws:SourceAccount to specify individual member account IDs.
Estimated Time:3m 0s
Rate this question

Topics

Enhancing Data Protection and Compliance