Examkin

Question

Difficulty: MediumSecurity and Compliance Control Design

A Solutions Architect is designing a centralized compliance auditing solution for a large enterprise. The enterprise has an AWS Organization containing multiple member accounts. The requirement is to enable AWS CloudTrail in all member accounts and have them deliver their log files to a single Amazon S3 bucket located in a dedicated Security account. All logs must be encrypted at rest. The solution must follow the principle of least privilege and prevent unauthorized accounts from writing to the S3 bucket or using the encryption key. Which of the following represents the most secure and compliant architecture design to meet these requirements?

  1. A
    In the Security account, configure the S3 bucket to use the AWS-managed KMS key (aws/s3) for default encryption. Configure the S3 bucket policy to allow the CloudTrail service principal (cloudtrail.amazonaws.com) from all member accounts to write to the bucket. Configure the organization-wide CloudTrail trail to use this S3 bucket.
  2. In the Security account, create a customer managed KMS key with a key policy that allows the CloudTrail service principal (cloudtrail.amazonaws.com) to perform kms:GenerateDataKey and kms:DescribeKey, restricted by a condition for the Organization ID. Configure the S3 bucket policy in the Security account to allow s3:PutObject and s3:GetBucketAcl for the CloudTrail service principal, also restricted by a condition for the Organization ID. Configure the organization-wide CloudTrail trail to use this S3 bucket and customer managed KMS key.Answer
  3. C
    In the Security account, create a customer managed KMS key with a key policy allowing the CloudTrail service principal. Configure the S3 bucket policy to allow s3:PutObject for a wildcard principal (*) to ensure all member accounts can write logs, relying on S3 Object Ownership to restrict read access to the Security account.
  4. D
    Create a Service Control Policy (SCP) at the AWS Organizations root level that allows s3:PutObject on the centralized S3 bucket and kms:GenerateDataKey on the encryption key for the CloudTrail service principal. Apply this SCP to all member account OUs, assuming this grants the required permissions without modifying the S3 bucket policy or the KMS key policy in the Security account.

Answer

Create a customer managed KMS key and an S3 bucket in the Security account. Configure their policies to allow the CloudTrail service principal, restricted by the AWS Organization ID, and configure the organization-wide CloudTrail trail to use these resources.
The correct answer provides a secure setup by using a customer managed KMS key, which allows key policies to be customized. The S3 bucket policy and KMS key policy both enforce least privilege by restricting access to the CloudTrail service principal under the specific AWS Organization ID condition, preventing unauthorized accounts from writing to the bucket or using the key.

Step-by-Step Solution

1
Identify the encryption requirements and select the appropriate KMS key type.
Determine that a Customer Managed Key (CMK) is required.
AWS-managed KMS keys (like aws/s3) do not allow policy modifications and cannot be shared cross-account or with external services across accounts.
2
Configure the S3 bucket policy and KMS key policy in the Security account.
Define policies that grant the CloudTrail service principal permission to perform write and key generation operations, restricted to the organization ID.
This implements the principle of least privilege, preventing external unauthorized entities from writing to the bucket or using the key.
3
Enable and configure the organization trail.
Configure the CloudTrail trail at the organization level to direct logs to the central S3 bucket and encrypt them using the CMK.
This automates log delivery from all current and future member accounts in the organization.

Key Concept

Cross-account resource sharing and encryption control design for centralized auditing using AWS KMS and Amazon S3 bucket policies.
Estimated Time:2m 0s
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic