Examkin

Question

Difficulty: EasyCentralized Monitoring, Logging, and Auditing Solutions

A solutions architect is designing a centralized logging architecture for a company's AWS Organization. The company wants to enable an organization-wide AWS CloudTrail trail in the management account and deliver all log files to a centralized Amazon S3 bucket located in a dedicated Security account. The security team requires all log files to be encrypted at rest using a Customer Managed Key (CMK) in AWS KMS. Which of the following configurations are required to implement this architecture? (Select TWO.)

  1. Configure the S3 bucket policy in the Security account to allow s3:PutObject and s3:GetBucketAcl actions for the cloudtrail.amazonaws.com service principal, with a condition checking that the aws:PrincipalOrgID matches the company's organization ID.Answer
  2. Create a customer managed KMS key in the Security account, and configure its key policy to grant the cloudtrail.amazonaws.com service principal permissions to perform kms:GenerateDataKey* and kms:DescribeKey actions.Answer
  3. C
    Configure the organization trail to encrypt the log files using the default AWS managed key for Amazon S3 (aws/s3) in the Security account.
  4. D
    Attach a Service Control Policy (SCP) at the organization root that explicitly grants the s3:PutObject permission to the cloudtrail.amazonaws.com service principal for the destination S3 bucket.
  5. E
    Configure the S3 bucket policy in the Security account to grant write permissions to the IAM root user principal of the management account, assuming other member accounts will inherit this access.

Answer

Configure the S3 bucket policy in the Security account to allow CloudTrail to write objects, restricted by the organization ID, and create a customer managed KMS key in the Security account with a key policy allowing CloudTrail to generate data keys and describe the key.
The correct solution involves configuring the S3 bucket policy in the destination Security account to allow access to the CloudTrail service principal (cloudtrail.amazonaws.com), restricted by the organization ID (aws:PrincipalOrgID) to ensure only logs from the company's organization are accepted. Furthermore, since AWS managed keys cannot be configured with custom policies to grant cross-account permissions, a customer managed KMS key must be created, and its key policy must allow the CloudTrail service principal to perform generate data key and describe key actions.

Step-by-Step Solution

1
Configure S3 bucket permissions in the Security account.
The S3 bucket policy is updated to allow the cloudtrail.amazonaws.com service principal to call s3:PutObject and s3:GetBucketAcl, restricted to the organization ID via the aws:PrincipalOrgID condition key.
This allows CloudTrail to write logs from any member account in the organization directly to the centralized bucket in the Security account while preventing unauthorized external write attempts.
2
Configure KMS key permissions in the Security account.
A customer managed KMS key is created and configured with a key policy that allows the cloudtrail.amazonaws.com service principal to use kms:GenerateDataKey* and kms:DescribeKey.
CloudTrail requires these permissions to generate data keys for encrypting log files on a per-account basis before delivering them. A customer managed key is required because AWS managed keys do not support policy modification for cross-account access.

Key Concept

Cross-account centralized logging using AWS CloudTrail requires configuring both resource-based permissions (S3 bucket policy) and encryption keys (KMS key policy) to trust the CloudTrail service principal, restricting access appropriately via organization-scoped condition keys.
Estimated Time:2m 0s
Rate this question

Topics

Centralized Monitoring, Logging, and Auditing Solutions

More questions from this topic