Examkin

Question

Difficulty: MediumSecurity and Compliance Control Design

A retail company, OmniStore, is setting up a centralized auditing pipeline. AWS CloudTrail logs from the main production account (Account A) must be delivered to a centralized Amazon S3 bucket located in the security operations account (Account B). The S3 bucket is encrypted using an AWS KMS Customer Managed Key (CMK) managed in Account B. The security architect must configure the access policies to allow CloudTrail to write the log files to Account B while enforcing least-privilege access. Which configuration strategy will allow CloudTrail to successfully deliver the logs to the encrypted S3 bucket in Account B?

  1. Configure the S3 bucket policy in Account B to allow the CloudTrail service principal (cloudtrail.amazonaws.com) to perform the s3:PutObject and s3:GetBucketAcl actions. Configure the key policy of the CMK in Account B to allow the CloudTrail service principal to perform the kms:GenerateDataKey action, using policy conditions to restrict access to the ARN of the CloudTrail in Account A.Answer
  2. B
    Configure the S3 bucket in Account B to use the default AWS-managed KMS key (aws/s3) for encryption. Configure the S3 bucket policy in Account B to allow the CloudTrail service principal (cloudtrail.amazonaws.com) to perform the s3:PutObject action.
  3. C
    Attach a Service Control Policy (SCP) to the organizational unit containing Account A that allows the kms:GenerateDataKey and s3:PutObject actions for the CloudTrail service principal. Omit updates to the KMS key policy and S3 bucket policy in Account B.
  4. D
    Configure the S3 bucket policy in Account B to allow the AWS account ID of Account A as the Principal for the s3:PutObject action, omitting the CloudTrail service principal (cloudtrail.amazonaws.com), and rely on Account A's local IAM policies to delegate write permissions to CloudTrail.

Answer

Configure the S3 bucket policy in Account B to allow the CloudTrail service principal (cloudtrail.amazonaws.com) to perform the s3:PutObject and s3:GetBucketAcl actions. Configure the key policy of the CMK in Account B to allow the CloudTrail service principal to perform the kms:GenerateDataKey action, using policy conditions to restrict access to the ARN of the CloudTrail in Account A.
The correct configuration requires granting permissions directly to the CloudTrail service principal (cloudtrail.amazonaws.com) in both the S3 bucket policy and the KMS key policy in Account B. Because this is a cross-account scenario, the S3 bucket policy must allow the service principal to write objects (s3:PutObject) and read bucket ACLs (s3:GetBucketAcl), and the Customer Managed Key (CMK) policy must grant the service principal permission to generate data keys (kms:GenerateDataKey) to encrypt the logs. Adding conditions ensures only logs from the specific production CloudTrail are accepted.

Step-by-Step Solution

1
Analyze the IAM identities involved in writing CloudTrail logs.
Identify that the CloudTrail service writes logs using the service principal 'cloudtrail.amazonaws.com', not local IAM roles in the source account.
Permissions must be granted directly to the CloudTrail service principal rather than the source account ID.
2
Determine the S3 bucket policy requirements for cross-account log delivery.
Identify that the target S3 bucket policy in Account B must allow 's3:PutObject' and 's3:GetBucketAcl' for the service principal 'cloudtrail.amazonaws.com'.
Cross-account S3 writes require explicit resource-based policy allowance for the writing identity.
3
Evaluate the KMS encryption configuration for cross-account S3 delivery.
Confirm that an AWS Customer Managed Key (CMK) must be used, and its key policy must grant 'kms:GenerateDataKey' to the service principal 'cloudtrail.amazonaws.com'.
AWS-managed keys (aws/s3) do not support policy modification and cannot be shared across accounts.

Key Concept

Cross-account AWS CloudTrail log delivery using KMS Customer Managed Keys (CMKs)
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic