A financial services company is designing a centralized auditing and logging architecture … — AWS Certified Solutions Architect - Professional

A financial services company is designing a centralized auditing and logging architecture for its AWS Organizations structure, which consists of $140$ member accounts. The security team requires all AWS CloudTrail logs from all accounts and regions to be consolidated into a single Amazon S3 bucket located in a dedicated Log Archive account.

The solution must meet the following requirements:
- All logs must be encrypted at rest using an AWS KMS Customer Managed Key (CMK) to comply with external regulations.
- Local administrators in the member accounts must be prevented from disabling logging, modifying trails, or deleting log archives.
- The principle of least privilege must be applied to S3 bucket and KMS key access.
- Administrative operations for CloudTrail must be delegated to a dedicated Security tooling account, avoiding the use of the Organizations management account for daily administration.

Which combination of configurations should a solutions architect implement to meet these requirements?

Register the Security tooling account as a delegated administrator for CloudTrail. In the Log Archive account, create an S3 bucket and a KMS customer managed key. Configure the S3 bucket policy to allow the s3:PutObject action for the CloudTrail service principal, restricted by the aws:PrincipalOrgID condition. Configure the KMS key policy to allow the kms:GenerateDataKey* and kms:DescribeKey actions for the CloudTrail service principal, restricted by the aws:PrincipalOrgID condition. In the Security tooling account, create an organization trail pointing to the central S3 bucket and KMS key. Apply a Service Control Policy (SCP) at the organization root that denies CloudTrail write and delete actions unless the caller is the delegated administrator.Answer
B
Register the Security tooling account as a delegated administrator for CloudTrail. In the Log Archive account, create an S3 bucket and enable default encryption using the AWS-managed KMS key for Amazon S3 (aws/s3). Configure the S3 bucket policy to allow the s3:PutObject action for the CloudTrail service principal. In the Security tooling account, create an organization trail pointing to the central S3 bucket. Apply a Service Control Policy (SCP) at the organization root that denies CloudTrail write and delete actions unless the caller is the delegated administrator.
C
Register the Security tooling account as a delegated administrator for CloudTrail. In the Log Archive account, create an S3 bucket and a KMS customer managed key. Configure the S3 bucket policy by explicitly listing the root ARN of each of the $140$ member accounts in the principal element for the s3:PutObject action. Configure the KMS key policy to explicitly list the root ARN of all member accounts. In the Security tooling account, create an organization trail pointing to the S3 bucket. Apply a Service Control Policy (SCP) at the organization root that denies CloudTrail write and delete actions unless the caller is the delegated administrator.
D
Register the Security tooling account as a delegated administrator for CloudTrail. In the Log Archive account, create an S3 bucket and a KMS customer managed key. Create a Service Control Policy (SCP) at the organization root that explicitly allows the s3:PutObject action and kms:GenerateDataKey* actions for the CloudTrail service in all OUs. In the Security tooling account, create an organization trail. Do not configure resource-based policies on the S3 bucket or KMS key in the Log Archive account, relying instead on the root SCP to authorize the log delivery.

Answer

Register the Security tooling account as a delegated administrator for CloudTrail. Create the S3 bucket and a KMS Customer Managed Key (CMK) in the Log Archive account. Configure both resource policies to allow the CloudTrail service principal (cloudtrail.amazonaws.com) to write logs and generate data keys, restricted by the aws:PrincipalOrgID condition. Create the organization trail from the Security tooling account, and apply a Service Control Policy (SCP) at the organization root to deny trail modification or deletion in the member accounts.

The correct solution correctly utilizes CloudTrail delegated administration to keep management account access restricted. It handles the cross-account encryption and delivery requirements by creating a Customer Managed Key and S3 bucket in the central Log Archive account, then configuring their respective resource policies to trust the CloudTrail service principal restricted by the aws:PrincipalOrgID condition. Finally, it uses an SCP to act as a guardrail preventing member accounts from altering the trail configuration.

Step-by-Step Solution

Enable delegated administration for CloudTrail in the Organizations management account, designating the Security tooling account.

The Security tooling account gains the ability to create and manage organization-wide trails on behalf of the entire AWS Organization.

This complies with the requirement to delegate administrative operations away from the management account.

Create the S3 bucket and a KMS Customer Managed Key (CMK) in the Log Archive account, and configure their resource-based policies.

The S3 bucket policy and KMS key policy allow the CloudTrail service principal (cloudtrail.amazonaws.com) to perform s3:PutObject, s3:GetBucketAcl, kms:GenerateDataKey*, and kms:DescribeKey actions under the condition that the source organization matches aws:PrincipalOrgID.

This establishes cross-account delivery permissions at scale without hitting policy size limits or manually maintaining account lists.

Create the organization trail from the delegated administrator (Security tooling) account and configure it to deliver to the Log Archive S3 bucket encrypted with the CMK.

CloudTrail automatically sets up logging for all member accounts and regions, delivering encrypted logs centrally.

This ensures comprehensive auditing across the organization.

Apply a Service Control Policy (SCP) at the root of the organization that denies CloudTrail modifications (e.g., StopLogging, UpdateTrail, DeleteTrail) unless the caller is the delegated administrator or the management account.

Local administrators in member accounts are prevented from stopping or modifying the organization trail, ensuring audit trail integrity.

This enforces the security mandate preventing log tampering.

Key Concept

Designing a secure, scaled centralized logging solution in a multi-account organization requires delegating administration, using KMS Customer Managed Keys for cross-account service encryption, writing scalable resource policies using organizational condition keys, and enforcing immutability through Service Control Policies.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic