Examkin

Question

Difficulty: HardCentralized Monitoring, Logging, and Auditing Solutions

A decentralized financial services platform operates a multi-account environment on AWS with 6565 member accounts managed via AWS Organizations. The compliance team requires all AWS API activity to be logged centrally in a dedicated Logging account. The logs must be encrypted at rest using a customer managed key (CMK) in AWS Key Management Service (AWS KMS), and the solution must enforce log file integrity. Additionally, member account administrators must be prevented from disabling the logging configuration or modifying the logging resources.

Which TWO actions should a Solutions Architect perform to implement this solution?

  1. Create an Amazon S3 bucket in the Logging account with a bucket policy that grants s3:PutObject and s3:GetBucketAcl permissions to the AWS CloudTrail service principal, using the aws:PrincipalOrgID condition to allow log delivery from all accounts in the organization, and enable log file integrity on the organization trail.Answer
  2. Create a customer managed KMS key in the Logging account with a key policy that grants the AWS CloudTrail service principal permissions to perform kms:GenerateDataKey* and kms:DescribeKey operations, using the aws:PrincipalOrgID condition key to restrict access to the organization, and configure the organization trail to use this key.Answer
  3. C
    Configure the S3 bucket in the Logging account to use the default AWS-managed KMS key for S3 (aws/s3) to automatically encrypt all incoming log objects from the organization without managing custom key policies.
  4. D
    Configure individual trails in the member accounts to use a cross-account IAM role in the Logging account that has write access to the S3 bucket, allowing member accounts to deliver logs directly.
  5. E
    Apply a Service Control Policy (SCP) at the Organization root that grants s3:PutObject and kms:GenerateDataKey* permissions to all IAM principals in the member accounts to permit log writing to the centralized logging bucket.

Answer

To implement centralized logging, the Solutions Architect must create an S3 bucket in the Logging account with a bucket policy permitting the CloudTrail service principal to write objects using the organization ID condition. Additionally, a customer managed KMS key must be created in the Logging account with a key policy allowing the CloudTrail service principal to generate data keys and describe keys, restricted by the organization ID condition.
The correct solution involves creating both the destination S3 bucket and the customer managed KMS key in the centralized Logging account. Because AWS CloudTrail delivers logs from various member accounts, it acts as a cross-account service writer. The S3 bucket policy must explicitly permit the AWS CloudTrail service principal to write logs, restricted to the AWS Organization using the principal organization ID condition. Similarly, since AWS-managed KMS keys cannot have their policies modified to authorize cross-account usage, a customer managed key is required. The customer managed KMS key policy must grant permissions to the CloudTrail service principal for key generation and description, restricted by the organization ID.

Step-by-Step Solution

1
Set up the destination S3 bucket and a customer managed KMS key in the centralized Logging account.
The logging infrastructure is deployed in the secure Logging account.
Centralizing logs requires destination resources to reside in the designated audit/security account to restrict administrative access.
2
Configure the S3 bucket policy and KMS key policy to permit cross-account writes from the CloudTrail service principal, using the aws:PrincipalOrgID condition key.
Resource-level permissions are in place allowing the organization's member accounts to deliver logs.
AWS-managed KMS keys do not support policy alterations required for cross-account service operations, necessitating a customer managed key.
3
Create an organization trail from the management or delegated administrator account, configuring S3 delivery to the central bucket, enabling log file integrity, and linking the customer managed KMS key.
API calls across all current and future member accounts are logged, encrypted, and validated centrally.
An organization trail automates the configuration across all member accounts and ensures compliance requirements are met.

Key Concept

Centralized cross-account logging in AWS Organizations requires using a customer managed KMS key with modified key policies and S3 bucket policies tailored for the CloudTrail service principal with organizational condition keys.
Estimated Time:3m 0s
Rate this question

Topics

Centralized Monitoring, Logging, and Auditing Solutions

More questions from this topic