Examkin

Question

Difficulty: Very hardSecurity and Compliance Control Design

An enterprise is designing a centralized compliance logging solution across its AWS Organization, which consists of a Management Account (111111111111111111111111), a Security Account (222222222222222222222222), and multiple production member accounts. The security team is setting up an organization trail from the Management Account to deliver logs to a centralized Amazon S3 bucket named `central-audit-logs` located in the Security Account. The company's compliance policy dictates that all logs must be encrypted at rest using a customer managed key (CMK) and that access to read these logs must be restricted to an auditor role in the Security Account, who federates via an external SAML Identity Provider (IdP). Which combination of configuration steps will successfully meet these requirements?

  1. Create a Customer Managed Key (CMK) in the Security Account. Update the CMK key policy to allow the CloudTrail service principal (`cloudtrail.amazonaws.com`) to perform `kms:GenerateDataKey*` and `kms:DescribeKey` actions, with a condition matching the organization trail ARN. Configure the S3 bucket policy in the Security Account to grant `s3:GetBucketAcl` and `s3:PutObject` permissions to the CloudTrail service principal, with a condition matching the AWS Organization ID. Configure the auditor role's trust policy with `sts:AssumeRoleWithSAML` pointing to the SAML IdP provider.Answer
  2. B
    Configure the organization trail to encrypt logs using the default AWS-managed KMS key `aws/s3` in the Security Account. Configure the S3 bucket policy in the Security Account to grant `s3:GetBucketAcl` and `s3:PutObject` permissions to the CloudTrail service principal, with a condition matching the AWS Organization ID. Grant the auditor role in the Security Account policy permissions for `s3:GetObject` on the bucket and `kms:Decrypt` on the `aws/s3` key, and configure its trust policy with `sts:AssumeRoleWithSAML` pointing to the SAML IdP.
  3. C
    Create a Customer Managed Key (CMK) in the Security Account. Update the CMK key policy and the S3 bucket policy in the Security Account to grant the member accounts' root ARNs (`arn:aws:iam::*:root`) permissions to perform `kms:GenerateDataKey*`, `kms:DescribeKey`, `s3:GetBucketAcl`, and `s3:PutObject`. Configure the auditor role's trust policy in the Security Account with `sts:AssumeRoleWithSAML` pointing to the SAML IdP.
  4. D
    Create a Customer Managed Key (CMK) in the Security Account. Update the CMK key policy to allow the CloudTrail service principal (`cloudtrail.amazonaws.com`) to perform `kms:GenerateDataKey*` and `kms:DescribeKey` actions, with a condition matching the organization trail ARN. Configure the S3 bucket policy in the Security Account to grant `s3:GetBucketAcl` and `s3:PutObject` permissions to the CloudTrail service principal, with a condition matching the AWS Organization ID. Configure the auditor role's trust policy in the Security Account with the `sts:AssumeRole` action and the principal pointing to the SAML IdP provider.

Answer

Create a Customer Managed Key (CMK) in the Security Account. Update the CMK key policy to allow the CloudTrail service principal (`cloudtrail.amazonaws.com`) to perform `kms:GenerateDataKey*` and `kms:DescribeKey` actions, with a condition matching the organization trail ARN. Configure the S3 bucket policy in the Security Account to grant `s3:GetBucketAcl` and `s3:PutObject` permissions to the CloudTrail service principal, with a condition matching the AWS Organization ID. Configure the auditor role's trust policy with `sts:AssumeRoleWithSAML` pointing to the SAML IdP provider.
The correct configuration combines three essential elements. First, a Customer Managed Key (CMK) is created in the Security Account, and its key policy is modified to allow the CloudTrail service principal (`cloudtrail.amazonaws.com`) to generate data keys for encrypting the log objects. Second, the S3 bucket policy allows the CloudTrail service principal to write logs cross-account, protected by a condition that restricts writes to the specific AWS Organization ID. Third, the auditor role's trust policy is configured with the `sts:AssumeRoleWithSAML` action, which is mandatory for external SAML 2.0 Identity Provider federation.

Step-by-Step Solution

1
Select the correct KMS key type and configure key access.
Create a Customer Managed Key (CMK) in the Security Account. Grant `kms:GenerateDataKey*` and `kms:DescribeKey` to `cloudtrail.amazonaws.com` with an `aws:SourceArn` condition pointing to the organization trail ARN.
AWS-managed keys cannot be shared cross-account or have their policies modified. A CMK is required to delegate permissions to the CloudTrail service principal.
2
Configure the centralized S3 bucket policy.
The S3 bucket policy must allow `s3:GetBucketAcl` and `s3:PutObject` to the principal `cloudtrail.amazonaws.com` with a condition verifying the Organization ID.
Since CloudTrail is a service, log delivery is executed by the service principal rather than the member accounts. Securing the policy with the Organization ID ensures only trails within the organization can write to the bucket.
3
Establish the SAML federation trust relationship.
Configure the auditor IAM role's trust policy with the action `sts:AssumeRoleWithSAML` and reference the SAML IdP ARN.
Standard cross-account delegation uses `sts:AssumeRole`, but direct federation with an external SAML Identity Provider must use `sts:AssumeRoleWithSAML` in the trust relationship.

Key Concept

Cross-account security controls integration for organization-wide logging, key management, and SAML federation.
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic