An enterprise is establishing a centralized compliance logging architecture for its multi-account AWS Organization. A Solutions Architect must configure an organization-wide AWS CloudTrail trail in the management account that consolidates log files into an Amazon S3 bucket located within a dedicated Security account. The security policy mandates that all logs must be encrypted at rest using SSE-KMS with a customer managed key, and access must adhere strictly to the principle of least privilege. Specifically, the configuration must prevent unauthorized access from member accounts while ensuring that CloudTrail can successfully write logs to the bucket. Which combination of configurations must the solutions architect implement to meet these requirements?
- AConfigure S3 bucket default encryption in the Security account using the AWS-managed KMS key (). Configure the S3 bucket policy in the Security account to allow and actions for the CloudTrail service principal () with a condition restricting the to the organization trail ARN.
- BConfigure the S3 bucket policy in the Security account to grant permissions to individual IAM roles created in each member account. Configure the Organization Trail to assume these member roles when writing logs to the centralized S3 bucket. Create a customer managed KMS key in the Security account and grant key access to the member account IAM roles.
- Configure the S3 bucket policy in the Security account to allow and actions for the CloudTrail service principal (), specifying the Organization Trail ARN in the condition. Create a customer managed KMS key in the Security account with a key policy that grants and to with a condition restricting the to the organization trail ARN.Answer
- DCreate a customer managed KMS key in the Security account and assign it to the Organization Trail. Attach a Service Control Policy (SCP) to the Root organizational unit that explicitly allows the CloudTrail service principal () to write to the centralized S3 bucket and use the KMS key, relying on the SCP to bypass local S3 bucket policies.