Examkin

Question

Difficulty: EasySecurity and Compliance Control Design

A solutions architect is configuring AWS CloudTrail in a member account to deliver log files to a centralized Amazon S3 bucket in a dedicated security account. The log delivery is currently failing. Which configuration must be applied to the S3 bucket in the security account to allow CloudTrail to write the logs?

  1. Configure the S3 bucket policy in the security account to allow the CloudTrail service principal (cloudtrail.amazonaws.com) to perform the s3:PutObject action.Answer
  2. B
    Configure the S3 bucket policy in the security account to grant access to the member account's root user principal, relying on the member account to delegate permissions to CloudTrail.
  3. C
    Attach a Service Control Policy (SCP) to the Organizational Unit (OU) of the member account that grants the s3:PutObject action on the centralized S3 bucket.
  4. D
    Configure default encryption on the centralized S3 bucket using the AWS managed key (aws/s3) and grant CloudTrail permissions to use this key.

Answer

Configure the S3 bucket policy in the security account to allow the CloudTrail service principal (cloudtrail.amazonaws.com) to perform the s3:PutObject action.
The correct configuration requires modifying the S3 bucket policy in the security account to grant the s3:PutObject permission directly to the CloudTrail service principal (cloudtrail.amazonaws.com). Since CloudTrail writes logs as an AWS service principal, a direct resource-based policy trust must be established on the destination bucket.

Step-by-Step Solution

1
Identify the writer principal.
The writer is the AWS CloudTrail service principal (cloudtrail.amazonaws.com), not an IAM user or role within the member account.
AWS services delivering logs act as service principals and must be granted permissions directly by the resource owner.
2
Configure the resource-based policy.
Apply an S3 bucket policy to the centralized bucket in the security account.
Cross-account resource access requires a resource-based policy (the S3 bucket policy) to authorize access from external principals.
3
Specify the action and conditions.
Grant s3:PutObject to cloudtrail.amazonaws.com, optionally adding conditions to restrict writes to specific organization IDs or ARNs.
This ensures only authorized CloudTrail trails can write to the centralized bucket, preventing unauthorized write attempts.

Key Concept

Cross-account resource sharing and service principal access delegation in AWS.
Estimated Time:1m 30s
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic