A media streaming company is setting up centralized logging for its multi-account AWS environment consisting of member accounts managed by AWS Organizations. The security team wants to store all AWS CloudTrail logs in a single Amazon S3 bucket located within a dedicated Security account. The security team also requires that the logs be encrypted at rest using an AWS KMS key that they manage. Which combination of configuration steps will allow AWS CloudTrail to successfully deliver the encrypted logs to the centralized S3 bucket?
- AConfigure the S3 bucket policy in the Security account to grant s3:PutObject permissions to the root user of each member account. Create a customer managed KMS key in the Security account with a key policy that grants kms:GenerateDataKey* permissions to the member accounts' root ARNs, and configure the trails in each member account to write to the bucket.
- Configure the S3 bucket policy in the Security account to grant s3:PutObject permissions to the cloudtrail.amazonaws.com service principal, conditioned on the AWS Organization ID. Create a customer managed KMS key in the Security account with a key policy that allows the cloudtrail.amazonaws.com service principal to use the kms:GenerateDataKey* and kms:DescribeKey actions, and configure the organization trail to use this key.Answer
- CConfigure the S3 bucket policy in the Security account to grant s3:PutObject permissions to the cloudtrail.amazonaws.com service principal, conditioned on the AWS Organization ID. Configure the organization trail to encrypt the logs using the default AWS-managed key for CloudTrail (aws/cloudtrail) in the Security account, and update its key policy to allow cross-account access.
- DAttach a Service Control Policy (SCP) to the organization root that allows member accounts' CloudTrail services to write to the centralized S3 bucket. Create a customer managed KMS key in the Security account, and configure the trail to use it by granting the member accounts' IAM admin roles permission to access the KMS key.
Answer
Configure the S3 bucket policy to allow the cloudtrail.amazonaws.com service principal to write logs, and use a customer managed KMS key with a key policy allowing the cloudtrail.amazonaws.com service principal to generate data keys.
The correct option is correct because cross-account CloudTrail log delivery requires granting permissions to the cloudtrail.amazonaws.com service principal in both the S3 bucket policy and the KMS key policy. A customer managed KMS key must be used because default AWS-managed keys (such as aws/cloudtrail) cannot be shared across accounts or have their key policies altered.
Step-by-Step Solution
Key Concept
Cross-account AWS CloudTrail log consolidation requires configuring resource policies (S3 bucket policy and KMS key policy) to trust the cloudtrail.amazonaws.com service principal. A Customer Managed Key (CMK) is mandatory because AWS-managed keys cannot be shared cross-account.
Estimated Time:2m 0s