Examkin

Question

Difficulty: HardCentralized Monitoring, Logging, and Auditing Solutions

A global healthcare technology enterprise manages 120120 member accounts within AWS Organizations. The security team requires a centralized auditing solution that aggregates AWS CloudTrail logs from all member accounts and regions into a single Amazon S3 bucket located in a dedicated Security account. The solution must ensure that all log data is encrypted at rest using a customer managed KMS key (KMS CMK). Additionally, member accounts must be prevented from disabling logging or modifying the trail configuration. Which TWO actions should the Solutions Architect take to implement this solution securely?

  1. Configure an organization trail from the management account, and specify a Customer Managed Key (CMK) in the Security account with a key policy that allows the 'cloudtrail.amazonaws.com' service principal to perform 'kms:GenerateDataKey*' and 'kms:DescribeKey' actions, restricted by a condition matching the organization's ID.Answer
  2. Apply a Service Control Policy (SCP) to the organization root that denies 'cloudtrail:DeleteTrail', 'cloudtrail:StopLogging', and 'cloudtrail:UpdateTrail' actions, unless the caller is the organization's management account.Answer
  3. C
    Configure the organization trail to encrypt logs using the AWS-managed KMS key for Amazon S3 ('aws/s3') in the Security account to simplify key management across all regions.
  4. D
    Attach a Service Control Policy (SCP) to the organization root that explicitly allows 'cloudtrail:StartLogging' and 'cloudtrail:CreateTrail' for all member accounts to ensure that logging permissions are enforced regardless of local IAM policies.
  5. E
    In the Security account, configure the central S3 bucket policy to grant 's3:PutObject' permissions directly to the IAM administrative roles in each member account.

Answer

Configure an organization trail from the management account using a Customer Managed Key in the Security account with a key policy allowing the CloudTrail service principal to perform key actions restricted by the AWS Organization ID, and apply a Service Control Policy to the organization root that denies deletion, stopping, or modification of the trail by member accounts.
To implement centralized auditing securely, the Solutions Architect must configure a customer managed KMS key in the Security account with a policy allowing the CloudTrail service principal to generate data keys, restricted by the organization's ID. Additionally, a Service Control Policy (SCP) must be attached to the organization root to deny modification or deletion of the trail by member accounts.

Step-by-Step Solution

1
Set up an AWS Organizations trail in the management account to capture events across all accounts.
Logs are automatically aggregated and delivered to the designated centralized S3 bucket in the Security account.
An organization trail ensures comprehensive logging across all member accounts without manual configuration in each account.
2
Configure a Customer Managed Key (CMK) in the Security account and update its policy to allow the CloudTrail service principal cross-account access, scoped with the Organization ID.
CloudTrail is authorized to generate data keys and encrypt log objects delivered to the S3 bucket.
AWS-managed keys cannot be shared cross-account, so a Customer Managed Key is required for cross-account logging encryption.
3
Deploy a Service Control Policy (SCP) at the organization root to deny modifications to CloudTrail configurations.
Member accounts cannot disable logging or delete the trail, enforcing compliance.
SCPs act as guardrails to prevent unauthorized configuration changes in member accounts.

Key Concept

Centralized Organization Trail with Cross-Account Customer Managed Keys and Service Control Policies
Rate this question

Topics

Centralized Monitoring, Logging, and Auditing Solutions

More questions from this topic