A retail conglomerate is establishing a centralized compliance and security auditing solution across its multi-account AWS Organization. The architecture requires that an organization-wide AWS CloudTrail trail be deployed to consolidate management and data events from all member accounts into a single Amazon S3 bucket located in a dedicated Security account. The logs must be encrypted at rest using SSE-KMS with a Customer Managed Key (CMK). The solution must ensure that member accounts cannot modify the auditing infrastructure or view the logs of other accounts, and it must enforce that all logs are encrypted using the designated key. Which TWO of the following configurations must a solutions architect implement to satisfy these requirements?
- Configure the S3 bucket policy in the Security account to grant s3:PutObject and s3:GetBucketAcl permissions to the cloudtrail.amazonaws.com service principal, restricting access using the aws:PrincipalOrgID condition key matching the organization ID.Answer
- Configure the KMS key policy of the Customer Managed Key in the Security account to grant kms:GenerateDataKey* and kms:DescribeKey permissions to the cloudtrail.amazonaws.com service principal, using the aws:SourceArn condition key to restrict access to the organization trail ARN.Answer
- CEnable default encryption on the S3 bucket using the AWS-managed KMS key aws/s3 in the Security account, and define a Service Control Policy (SCP) that forces member accounts to encrypt CloudTrail logs with this key.
- DAttach a Service Control Policy (SCP) to the organization's root that grants s3:PutObject and kms:GenerateDataKey* permissions to the cloudtrail.amazonaws.com service principal, allowing cross-account delivery without S3 or KMS policies in the Security account.
- EConfigure the S3 bucket policy in the Security account to grant write permissions to the root user of each member account, and rely on IAM policies within the member accounts to authorize the CloudTrail service to write to the S3 bucket.