Examkin

Question

Difficulty: MediumCentralized Monitoring, Logging, and Auditing Solutions

A logistics enterprise manages 5050 AWS accounts under a single organization in AWS Organizations. The security team is implementing an organization trail in AWS CloudTrail that will write log files to a centralized Amazon S3 bucket located in a dedicated Security account. The logs must be encrypted at rest using a customer managed key (CMK) in AWS Key Management Service (AWS KMS). What configuration must be implemented to allow CloudTrail to successfully deliver encrypted log files to the centralized S3 bucket?

  1. Configure the S3 bucket policy in the Security account to grant s3:PutObject permissions to the CloudTrail service principal (cloudtrail.amazonaws.com) with a condition restricting writes to the organization's trail. Additionally, configure the KMS key policy of the CMK to grant the CloudTrail service principal permissions for kms:GenerateDataKey* and kms:DescribeKey with appropriate resource conditions.Answer
  2. B
    Configure the S3 bucket policy in the Security account to grant write permissions to the CloudTrail service principal. For encryption, configure the organization trail to use the default AWS-managed KMS key for Amazon S3 (aws/s3) in the Security account to encrypt the logs.
  3. C
    Create a Service Control Policy (SCP) at the root of the organization that allows s3:PutObject and kms:GenerateDataKey* for the CloudTrail service principal. Apply this SCP to all Organizational Units (OUs) to automatically delegate log delivery permissions without modifying the S3 bucket policy or the KMS key policy in the Security account.
  4. D
    Configure the S3 bucket policy in the Security account to grant write permissions to the IAM roles of the administrators in the member accounts. Configure the KMS key policy to trust the member accounts' IAM roles to perform encryption operations on behalf of CloudTrail.

Answer

To configure centralized logging with an organization trail and a customer managed KMS key, the S3 bucket policy and the KMS key policy in the Security account must explicitly trust the CloudTrail service principal (cloudtrail.amazonaws.com) and grant it the necessary write and key generation permissions.
The correct answer accurately configures both resource policies (the S3 bucket policy and the KMS key policy) to grant the necessary permissions to the CloudTrail service principal (cloudtrail.amazonaws.com) using security conditions to prevent unauthorized log writing and key usage.

Step-by-Step Solution

1
Identify the writer of the logs.
The AWS CloudTrail service principal (cloudtrail.amazonaws.com) delivers logs, not individual member account IAM identities.
This determines which principal needs permissions in the target S3 bucket and KMS policies.
2
Evaluate key types for cross-account KMS usage.
Default AWS-managed keys (like aws/s3) cannot be shared or modified via policies, requiring a Customer Managed Key (CMK) instead.
AWS CloudTrail needs cross-account access to encrypt logs when writing to a bucket in another account.
3
Examine policy capabilities (SCPs vs resource policies).
SCPs do not grant permissions across accounts; resource policies on both the S3 bucket and the KMS key must explicitly grant permissions to the CloudTrail service principal.
This clarifies why the target policies must be modified and why SCP configurations alone are insufficient.

Key Concept

Cross-Account Centralized Trail Log Delivery and Encryption
Rate this question

Topics

Centralized Monitoring, Logging, and Auditing Solutions

More questions from this topic