A shipping logistics enterprise is setting up centralized logging for all member accounts within its AWS Organizations structure. The security team requires that AWS CloudTrail logs from all accounts be delivered to a single Amazon S3 bucket in a dedicated Logging account. The logs must be encrypted using AWS KMS. The architecture must ensure that member accounts cannot modify CloudTrail settings or access the centralized S3 bucket directly. Which configuration meets these requirements?
- Create an organization trail in the Organizations management account that delivers logs to the S3 bucket in the Logging account. Configure the S3 bucket policy to allow write access to the CloudTrail service principal for the Organization. Create a customer managed KMS key in the Logging account with a key policy allowing the CloudTrail service principal to generate data keys, and use this key to encrypt the trail. Attach an SCP to the Organization root that denies member accounts from disabling CloudTrail or accessing the Logging account's S3 bucket.Answer
- BCreate an organization trail in the Organizations management account that delivers logs to the S3 bucket in the Logging account. Configure the S3 bucket policy to allow write access to the CloudTrail service principal for the Organization. Enable encryption on the trail using the default AWS-managed KMS key (aws/cloudtrail) in the Logging account, and update the default key policy to allow cross-account usage. Attach an SCP to the Organization root that denies member accounts from disabling CloudTrail or accessing the Logging account's S3 bucket.
- CCreate a local CloudTrail trail in each member account that delivers logs to the S3 bucket in the Logging account. Attach an SCP to the Organization root that grants the member accounts' CloudTrail service principal write permissions to the Logging account's S3 bucket and decrypt permissions for the KMS key. Remove the bucket policy from the S3 bucket in the Logging account to simplify administration, and deny member accounts from disabling CloudTrail.
- DCreate an organization trail in the Organizations management account that delivers logs to the S3 bucket in the Logging account. Configure the S3 bucket policy in the Logging account to grant read/write access to the Organization's management account IAM users, assuming CloudTrail inherits these management account permissions during log delivery. Create a customer managed KMS key in the Logging account with a key policy allowing the management account to generate data keys. Attach an SCP to the Organization root that denies member accounts from disabling CloudTrail.
Answer
The correct configuration is to create an organization trail in the management account, write to an S3 bucket in the Logging account using a customer managed KMS key, configure resource-based policies to allow the CloudTrail service principal access, and apply an SCP to prevent modification of the trail and direct access to the logging bucket.
The correct solution involves setting up an organization trail, which centralizes management and automatically includes all member accounts. Because the logs are encrypted and stored in a different account, a Customer Managed Key (CMK) must be used since AWS-managed KMS keys do not support policy modification to allow cross-account access. The S3 bucket policy and KMS key policy must grant permissions specifically to the CloudTrail service principal (cloudtrail.amazonaws.com). Finally, an SCP is used as a guardrail to prevent member accounts from stopping logging or accessing the logging bucket directly.
Step-by-Step Solution
Key Concept
Centralized cross-account logging with AWS CloudTrail, KMS Customer Managed Keys, and Service Control Policies.
Estimated Time:2m 0s