An enterprise manages member accounts in an AWS Organization. The security team requires all custom application logs currently written to Amazon CloudWatch Logs groups in the member accounts to be consolidated into a single Amazon S3 bucket in a central Logging account. The centralized logs must be encrypted at rest using a Customer Managed Key (CMK) in AWS KMS. Which solution meets these requirements with the least administrative overhead?
- AIn the central Logging account, create the S3 bucket and configure an S3 bucket policy that permits all member accounts to perform s3:PutObject. In each member account, create a CloudWatch Logs subscription filter that directly references the central S3 bucket ARN as the destination, using a customer managed KMS key in each member account for encryption.
- BIn the central Logging account, create an Amazon Data Firehose delivery stream that writes to the S3 bucket. Configure the S3 bucket to use the default AWS-managed KMS key (aws/s3) for encryption. In the central Logging account, create a CloudWatch Logs destination that points to the Firehose stream, and configure its policy to permit the member accounts. In each member account, configure a subscription filter pointing to the destination.
- In the central Logging account, create an Amazon Data Firehose delivery stream that writes to the S3 bucket, and create a CloudWatch Logs destination that points to this stream. Update the destination policy to permit the logs:PutSubscriptionFilter action for the AWS Organization. Create an AWS KMS customer managed key (CMK) and configure its key policy to allow Data Firehose to perform kms:GenerateDataKey and kms:Encrypt operations. In each member account, create a CloudWatch Logs subscription filter associated with the central destination.Answer
- DIn the central Logging account, create an Amazon Data Firehose delivery stream pointing to the S3 bucket. Attach a Service Control Policy (SCP) to the Root organizational unit (OU) that grants the member accounts logs:PutSubscriptionFilter permission to write directly to the central Data Firehose stream, and configure a customer managed KMS key in the central account.
Answer
Create an Amazon Data Firehose delivery stream and a CloudWatch Logs destination in the central Logging account, configuring the destination policy to allow the AWS Organization to write log data. Use a Customer Managed Key (CMK) with a key policy allowing Data Firehose to perform encryption, and set up subscription filters in the member accounts targeting the destination.
The correct solution uses a CloudWatch Logs destination in the central Logging account to receive log streams from other accounts. The destination routes the logs to an Amazon Data Firehose delivery stream, which writes them to the S3 bucket. Since the logs must be encrypted using a Customer Managed Key (CMK), the key policy must grant permissions to the Data Firehose service role to generate data keys and encrypt the data.
Step-by-Step Solution
Key Concept
Cross-account log aggregation with CloudWatch Logs Destinations, Amazon Data Firehose, and KMS Customer Managed Keys.