A multinational financial enterprise is consolidating its network monitoring strategy across 150 member accounts within an AWS Organizations structure. A Solutions Architect must configure Amazon VPC Flow Logs in all member accounts to write directly to a single, centralized Amazon S3 bucket located in a dedicated Security account. The enterprise's security policy mandates that all logs must be encrypted at rest using an AWS KMS customer managed key owned by the Security account. Additionally, access must be restricted to ensure only the enterprise's organization can write to the bucket, and member accounts must not be able to read each other's logs. Which combination of configurations will meet these requirements while minimizing operational overhead?
- AIn the Security account, configure the S3 bucket policy to allow the `delivery.logs.amazonaws.com` service principal to perform `s3:PutObject` and `s3:GetBucketAcl` actions, restricted by the `aws:PrincipalOrgID` condition. Enable default bucket encryption using the AWS-managed KMS key (`aws/s3`) in the Security account to avoid KMS key policy management overhead. In the member accounts, configure VPC Flow Logs to publish directly to the central S3 bucket.
- BIn the Security account, configure the S3 bucket policy to allow the IAM roles of the member accounts to perform `s3:PutObject` and `s3:GetBucketAcl` actions, restricted by the `aws:PrincipalOrgID` condition. Configure the Security account's KMS key policy to allow the same member account IAM roles to perform `kms:GenerateDataKey*` and `kms:Decrypt` actions. In the member accounts, configure VPC Flow Logs to use an IAM role that writes to the central S3 bucket.
- In the Security account, configure the S3 bucket policy to allow the `delivery.logs.amazonaws.com` service principal to perform `s3:PutObject` and `s3:GetBucketAcl` actions, restricted by the `aws:PrincipalOrgID` condition. In the Security account's KMS key policy, allow `delivery.logs.amazonaws.com` to perform `kms:GenerateDataKey*` and `kms:Decrypt` actions. In the member accounts, configure VPC Flow Logs to publish directly to the central S3 bucket.Answer
- DIn the Security account, configure the S3 bucket policy to allow the `delivery.logs.amazonaws.com` service principal to perform `s3:PutObject` and `s3:GetBucketAcl` actions, restricted by the `aws:PrincipalOrgID` condition. In the Security account's KMS key policy, allow only the root account of the Security account to manage the key, relying on the S3 bucket policy's `PutObject` permission to implicitly delegate KMS encryption permissions to the Log Delivery service. In the member accounts, configure VPC Flow Logs to publish directly to the central S3 bucket.
Answer
Configure the S3 bucket policy to allow the `delivery.logs.amazonaws.com` service principal to perform `s3:PutObject` and `s3:GetBucketAcl` actions with the `aws:PrincipalOrgID` condition. Grant `kms:GenerateDataKey*` and `kms:Decrypt` permissions to `delivery.logs.amazonaws.com` in the KMS key policy, and configure VPC Flow Logs to write directly to the bucket.
The correct solution involves configuring the S3 bucket policy to grant permissions to the Log Delivery service principal (`delivery.logs.amazonaws.com`) rather than local IAM roles, and explicitly allowing the same service principal to use the customer managed key in the KMS key policy. This is because cross-account log delivery for VPC Flow Logs runs under the Log Delivery service principal. Restricting access using the `aws:PrincipalOrgID` condition ensures that only VPC Flow Logs from within the organization can write to the bucket, maintaining security and preventing external writers.
Step-by-Step Solution
Key Concept
Cross-account log delivery via the Log Delivery service principal with SSE-KMS encryption using a Customer Managed Key.