Examkin

Question

Difficulty: HardCentralized Monitoring, Logging, and Auditing Solutions

An enterprise manages a multi-account environment with 180180 AWS accounts organized under AWS Organizations. The security team is designing a centralized auditing solution to aggregate VPC Flow Logs from all VPCs in all member accounts into a single Amazon S3 bucket located in a dedicated Security account. The S3 bucket must be encrypted using a Customer Managed Key (CMK) in AWS Key Management Service (AWS KMS). The solution must prevent member accounts from reading or deleting logs, while allowing the log delivery service to write logs directly to the bucket.

Which of the following actions should the Solutions Architect perform to meet these requirements? (Select TWO.)

  1. In the Security account's S3 bucket policy, grant the s3:PutObject and s3:GetBucketAcl permissions to the delivery.logs.amazonaws.com service principal, restricting access using the aws:PrincipalOrgID condition.Answer
  2. In the Security account's KMS key policy, grant the kms:GenerateDataKey* and kms:Decrypt permissions to the delivery.logs.amazonaws.com service principal, restricting access using the aws:PrincipalOrgID condition.Answer
  3. C
    Configure the S3 bucket encryption using the default AWS managed key (aws/s3) to simplify key management and automate access controls across all member accounts.
  4. D
    Apply a Service Control Policy (SCP) at the organization root that grants the s3:PutObject permission to member accounts for the Security account S3 bucket, ensuring that member accounts can write but not read logs.
  5. E
    In the Security account's S3 bucket policy, grant the s3:PutObject and s3:DeleteObject permissions to the root principal of all member accounts using the aws:PrincipalOrgID condition, and configure IAM policies in member accounts to deny read actions.

Answer

The correct actions are to configure the S3 bucket policy to allow the log delivery service principal (delivery.logs.amazonaws.com) to write objects and get bucket ACLs, and to configure the KMS key policy to allow the same service principal to generate data keys and decrypt.
To centrally aggregate VPC Flow Logs in a cross-account S3 bucket, the S3 bucket policy must grant s3:PutObject and s3:GetBucketAcl to the log delivery service principal (delivery.logs.amazonaws.com). Furthermore, when the destination S3 bucket is encrypted using a Customer Managed Key (CMK) in AWS KMS, the KMS key policy must grant permissions such as kms:GenerateDataKey* and kms:Decrypt to the same log delivery service principal. Using the aws:PrincipalOrgID condition ensures that only VPCs belonging to accounts within the organization can write logs to the bucket.

Step-by-Step Solution

1
Configure the S3 bucket policy in the Security account.
Allows the delivery.logs.amazonaws.com service principal to perform s3:PutObject and s3:GetBucketAcl restricted by aws:PrincipalOrgID.
Enables the VPC Flow Logs log delivery service to publish logs to the cross-account bucket while restricting access to the AWS Organization.
2
Configure the KMS key policy for the Customer Managed Key (CMK) in the Security account.
Allows the delivery.logs.amazonaws.com service principal to use the key via kms:GenerateDataKey* and kms:Decrypt.
Allows the log delivery service to encrypt log objects before writing them to the encrypted S3 bucket.
3
Configure VPC Flow Logs in the member accounts' VPCs to point to the Security account S3 bucket.
Initiates flow log delivery to the central S3 bucket.
Establishes log aggregation from spoke VPCs to the central logging repository.

Key Concept

Cross-account log aggregation for VPC Flow Logs requires configuring the destination S3 bucket policy and KMS key policy to trust the AWS Log Delivery service principal (delivery.logs.amazonaws.com), rather than individual member account IAM principals.
Estimated Time:3m 0s
Rate this question

Topics

Centralized Monitoring, Logging, and Auditing Solutions

More questions from this topic