Examkin

Question

Difficulty: MediumCentralized Monitoring, Logging, and Auditing Solutions

A software-as-a-service (SaaS) provider manages 5050 AWS accounts using AWS Organizations. The security team is setting up an organization-wide trail in AWS CloudTrail to consolidate log delivery into a centralized Amazon S3 bucket in a dedicated Logging account. They require all consolidated logs to be encrypted at rest using an AWS Key Management Service (AWS KMS) key.

Which configuration is required to successfully deliver the encrypted logs from all accounts to the centralized S3 bucket?

  1. Configure the S3 bucket policy in the Logging account to allow the s3:PutObject and s3:GetBucketAcl actions for the cloudtrail.amazonaws.com service principal with a condition matching the organization ID. Create a customer managed KMS key in the Logging account with a key policy that grants the kms:GenerateDataKey* and kms:DescribeKey permissions to the CloudTrail service principal with a condition matching the organization ARN.Answer
  2. B
    Configure the S3 bucket policy in the Logging account to allow the s3:PutObject and s3:GetBucketAcl actions for the cloudtrail.amazonaws.com service principal with a condition matching the organization ID. Enable default S3 bucket encryption using the AWS-managed KMS key for S3 (aws/s3) in the Logging account, and configure the trail to use this key.
  3. C
    Create a customer managed KMS key in the Logging account with a key policy that grants the kms:GenerateDataKey* and kms:DescribeKey permissions to the CloudTrail service principal. Create an IAM role in the Logging account that allows the CloudTrail service principal to write to the S3 bucket, and rely on IAM delegation for member accounts without modifying the S3 bucket policy.
  4. D
    Create a customer managed KMS key in the Logging account with a key policy that grants the kms:GenerateDataKey* and kms:DescribeKey permissions to the CloudTrail service principal. Attach a Service Control Policy (SCP) to the root of the AWS Organization that explicitly grants the s3:PutObject permission on the centralized S3 bucket to the CloudTrail service principal for all OUs.

Answer

Configure the S3 bucket policy in the Logging account to allow the s3:PutObject and s3:GetBucketAcl actions for the cloudtrail.amazonaws.com service principal with a condition matching the organization ID. Create a customer managed KMS key in the Logging account with a key policy that grants the kms:GenerateDataKey* and kms:DescribeKey permissions to the CloudTrail service principal with a condition matching the organization ARN.
The correct answer provides the necessary resource-based policies to authorize cross-account CloudTrail log delivery and KMS encryption. Specifically, the S3 bucket policy must allow the cloudtrail.amazonaws.com service principal to write objects and read ACLs, restricted to the organization ID. In addition, because logs from member accounts are delivered to a centralized bucket, an AWS-managed KMS key cannot be used since its policy cannot be modified to permit cross-account access. Therefore, a customer managed KMS key must be created, and its key policy must allow the CloudTrail service principal to generate data keys on behalf of the organization's accounts.

Step-by-Step Solution

1
Configure permissions for the S3 bucket in the Logging account.
The S3 bucket policy is updated to allow the cloudtrail.amazonaws.com service principal to write logs (s3:PutObject) and read bucket ACLs (s3:GetBucketAcl), restricted to the Organization ID using the aws:PrincipalOrgID condition.
CloudTrail requires explicit bucket policy permissions to deliver logs to an S3 bucket in a different account.
2
Create and configure a Customer Managed Key (CMK) in AWS KMS.
A customer managed KMS key is created in the Logging account. The key policy is configured to grant kms:GenerateDataKey* and kms:DescribeKey permissions to the cloudtrail.amazonaws.com service principal, with conditions to restrict usage to trails within the Organization.
AWS-managed KMS keys cannot be shared cross-account. Consolidating encrypted logs from multiple member accounts requires a customer managed key with a custom key policy that allows cross-account usage.
3
Enable the KMS encryption on the organization trail.
The organization trail is configured to encrypt logs using the newly created customer managed KMS key.
This ensures that all logs delivered from any member account in the organization are securely encrypted using the customer managed KMS key before being stored in the centralized S3 bucket.

Key Concept

Centralized cross-account logging with encryption using AWS KMS customer managed keys and S3 bucket policies in a multi-account organization.
Estimated Time:2m 30s
Rate this question

Topics

Centralized Monitoring, Logging, and Auditing Solutions

More questions from this topic