Examkin

Question

Difficulty: MediumCentralized Monitoring, Logging, and Auditing Solutions

A technology enterprise is designing a centralized monitoring and auditing solution for its AWS Organization, which contains 4040 member accounts. The security team requires that VPC Flow Logs from all VPCs across all member accounts be consolidated into a single Amazon S3 bucket located in a dedicated Monitoring account. The logs must be encrypted at rest using an AWS KMS key, and the transmission of logs must be secure and isolated to the organization. Which TWO configurations are required to establish this centralized log delivery architecture?

  1. A
    Configure the centralized S3 bucket to use the default AWS-managed KMS key (aws/s3) to encrypt the delivered flow logs.
  2. B
    Configure an IAM role in each member account with s3:PutObject permissions for the centralized S3 bucket, and attach this role to the VPC Flow Logs configuration.
  3. C
    Attach a Service Control Policy (SCP) at the Organization root that explicitly grants s3:PutObject permissions to all member accounts for the destination S3 bucket.
  4. Configure the S3 bucket policy in the Monitoring account to grant s3:PutObject and s3:GetBucketAcl permissions to the delivery.logs.amazonaws.com service principal.Answer
  5. Create a Customer Managed Key (CMK) in the Monitoring account, and configure its key policy to allow the delivery.logs.amazonaws.com service principal to use the kms:GenerateDataKey* and kms:Decrypt actions.Answer

Answer

Configure the S3 bucket policy to allow the log delivery service principal to write objects and read bucket ACLs, and use a Customer Managed Key (CMK) with a key policy that grants the log delivery service principal permissions to generate data keys and decrypt.
The correct architecture uses the S3 bucket policy to grant necessary permissions to the AWS Log Delivery service principal (delivery.logs.amazonaws.com). In addition, since the logs are delivered across accounts and must be encrypted, a Customer Managed Key (CMK) must be configured to allow the log delivery service to generate data keys for encryption.

Step-by-Step Solution

1
Configure the destination Amazon S3 bucket policy in the Monitoring account.
The S3 bucket policy is updated to grant s3:PutObject and s3:GetBucketAcl permissions to the delivery.logs.amazonaws.com service principal, restricted by the Organization ID or source account IDs.
This allows the native AWS Log Delivery service to deliver the flow logs to the centralized bucket across account boundaries.
2
Create and configure a Customer Managed Key (CMK) in AWS KMS within the Monitoring account.
A Customer Managed Key is set up with a policy that allows the delivery.logs.amazonaws.com service principal to call kms:GenerateDataKey* and kms:Decrypt.
AWS-managed KMS keys do not support policy modification and cannot be used for cross-account log delivery encryption; thus, a Customer Managed Key must be used.

Key Concept

Centralized VPC Flow Logs delivery requires configuring permissions on both the S3 bucket and the KMS Customer Managed Key to allow the delivery.logs.amazonaws.com service principal to write and encrypt logs cross-account.
Rate this question

Topics

Centralized Monitoring, Logging, and Auditing Solutions

More questions from this topic