Examkin

Question

Difficulty: HardCentralized Monitoring, Logging, and Auditing Solutions

A digital manufacturing enterprise operates a multi-account environment with 115115 AWS accounts organized under AWS Organizations. The compliance officer mandates that all API activity across all accounts and regions must be centrally logged and audited. The solutions architect designs a solution to consolidate AWS CloudTrail logs into an Amazon S3 bucket within a dedicated Security account. The architecture must satisfy the following constraints:
- All log data at rest must be encrypted using a Customer Managed Key (CMK) in AWS KMS.
- Member accounts must be prevented from disabling or altering the logging configuration.
- The S3 bucket policy and the KMS key policy must enforce least-privilege access, restricting delivery only to CloudTrail for accounts belonging to the organization.
- AWS-managed KMS keys must not be used due to security policies restricting cross-account key sharing.

Which configuration strategy should the solutions architect implement to meet these requirements?

  1. Configure an organization trail in the management account that delivers logs to the S3 bucket in the Security account, encrypted by a customer managed KMS CMK in the Security account. Configure the S3 bucket policy to allow s3:PutObject for the CloudTrail service principal with a condition for the Organization ID. Configure the KMS key policy in the Security account to allow kms:GenerateDataKey* and kms:DescribeKey for the CloudTrail service principal with a condition for the Organization ID. Apply a Service Control Policy to the organization's root that denies CloudTrail modification and deletion actions.Answer
  2. B
    Configure an organization trail in the management account that delivers logs to the S3 bucket in the Security account. Configure the S3 bucket to use the default AWS-managed KMS key for S3 (aws/s3) for encryption. Update the S3 bucket policy to allow the CloudTrail service principal from the organization's member accounts to write to the bucket. Apply a Service Control Policy to the organization's root to prevent member accounts from modifying the trail configuration.
  3. C
    Configure an organization trail in the management account that delivers logs to the S3 bucket in the Security account. Create a customer managed KMS CMK in the Security account. Apply a Service Control Policy to the organization's root that explicitly grants kms:GenerateDataKey* and kms:Decrypt permissions to the CloudTrail service principal for the KMS CMK ARN, while denying any modifications to CloudTrail configurations in the member accounts.
  4. D
    Configure individual trails in each member account using AWS CloudFormation StackSets to deliver logs to the S3 bucket in the Security account, encrypted by a customer managed KMS CMK in the Security account. Rely on the IAM policies attached to the CloudTrail service roles in the member accounts to grant the necessary write permissions to the S3 bucket. Apply a Service Control Policy to deny member accounts the ability to delete the CloudFormation stacks.

Answer

Configure an organization trail in the management account that delivers logs to the S3 bucket in the Security account, encrypted by a customer managed KMS CMK in the Security account. Configure the S3 bucket policy to allow s3:PutObject for the CloudTrail service principal with a condition for the Organization ID. Configure the KMS key policy in the Security account to allow kms:GenerateDataKey* and kms:DescribeKey for the CloudTrail service principal with a condition for the Organization ID. Apply a Service Control Policy to the organization's root that denies CloudTrail modification and deletion actions.
The correct strategy leverages an organization trail, which dynamically configures logging across all current and future accounts in the organization. To support cross-account logging securely, a customer managed key is deployed in the Security account, and its key policy is modified to allow the CloudTrail service principal to use it, restricted to the organization's ID using the aws:PrincipalOrgID condition. The centralized S3 bucket policy is similarly configured to permit CloudTrail log delivery only from the organization. Finally, an SCP attached to the root of the organization enforces compliance by preventing member accounts from stopping or modifying the logging setup.

Step-by-Step Solution

1
Deploy a centralized Amazon S3 bucket and a Customer Managed KMS CMK in the Security account.
Establishes the centralized storage and cryptographic key under the control of the security team.
Allows compliance with the requirement to use a customer managed key and store logs centrally.
2
Configure the S3 bucket policy and KMS key policy to permit the CloudTrail service principal to put objects and generate data keys, scoped using the aws:PrincipalOrgID condition matching the Organization ID.
Permits only the CloudTrail service acting on behalf of the organization's accounts to write logs and use the encryption key.
Ensures cross-account log delivery works under the principle of least privilege, blocking external delivery attempts.
3
Create an organization trail from the management account (or delegated administrator) pointing to the centralized S3 bucket and KMS CMK.
Enables log collection automatically across all existing and future member accounts within the organization.
Ensures complete coverage of API logs without manual configuration per account.
4
Attach a Service Control Policy (SCP) at the root level of the organization to deny write and delete API calls on CloudTrail resources.
Prevents administrators or users in member accounts from stopping the logging or altering the trail configuration.
Meets the security requirement to prevent tampering with logging configurations.

Key Concept

Centralized Organization Trail with S3 Bucket Policies and Customer Managed KMS CMK Policies
Rate this question

Topics

Centralized Monitoring, Logging, and Auditing Solutions

More questions from this topic