Examkin

Question

Difficulty: HardCentralized Monitoring, Logging, and Auditing Solutions

An enterprise with 120120 member accounts under a single organization in AWS Organizations is designing a centralized logging solution. The security team wants to aggregate application logs from Amazon CloudWatch Logs across all member accounts into a central Amazon Kinesis Data Firehose delivery stream in a dedicated Log Archive account. The logs must be delivered to an Amazon S3 bucket in the Log Archive account and encrypted at rest using a Customer Managed Key (CMK) in AWS KMS. The solution must minimize administrative overhead and enforce the principle of least privilege. Which of the following actions should the solutions architect perform to meet these requirements? (Select TWO.)

  1. In the Log Archive account, create a CloudWatch Logs destination pointing to the Kinesis Data Firehose delivery stream. Attach a destination policy to the destination that grants the logs:PutSubscriptionFilter permission to the wildcard principal * with a condition restricting access to the AWS Organization's ID (aws:PrincipalOrgID).Answer
  2. In the Log Archive account, create an IAM role that trusts the logs.amazonaws.com service principal, with a condition restricting the source account to the Log Archive account. Grant this role permissions to put records into the Kinesis Data Firehose delivery stream.Answer
  3. C
    Configure the Kinesis Data Firehose delivery stream to write directly to the S3 bucket, and configure the S3 bucket policy in the Log Archive account to grant s3:PutObject permissions to the IAM roles of the 120120 member accounts.
  4. D
    Configure the Kinesis Data Firehose delivery stream to use the default AWS-managed key for Amazon S3 (aws/s3) for encryption at rest, and modify the key policy of aws/s3 to allow Kinesis Data Firehose cross-account decryption permissions.
  5. E
    Attach a Service Control Policy (SCP) to the organization's root OU that grants the logs:PutSubscriptionFilter permission to all member accounts, which automatically authorizes them to stream logs to the Log Archive account without requiring local IAM permissions.

Answer

In the Log Archive account, create a CloudWatch Logs destination pointing to Kinesis Data Firehose with a destination policy that grants logs:PutSubscriptionFilter to the organization ID, and create an IAM role that trusts the logs.amazonaws.com service principal with a condition restricting the source account to the Log Archive account to put records into the Kinesis Data Firehose delivery stream.
The correct solution involves creating a CloudWatch Logs destination in the Log Archive account, which acts as the centralized log receiver. The destination policy must grant logs:PutSubscriptionFilter permissions to the member accounts, which is best achieved by specifying a wildcard principal and filtering by the organization's ID using the aws:PrincipalOrgID condition. Additionally, CloudWatch Logs needs permission to put logs into the Kinesis Data Firehose stream, which requires an IAM role in the Log Archive account that trusts the logs.amazonaws.com service principal and restricts it using the aws:SourceAccount condition to prevent cross-account confused deputy exploits.

Step-by-Step Solution

1
Create an IAM role in the Log Archive account that CloudWatch Logs can assume to write events to Kinesis Data Firehose.
An IAM role is created with a trust policy allowing logs.amazonaws.com to assume it, restricted by the aws:SourceAccount condition.
This establishes the secure trust boundary allowing the CloudWatch Logs service to write logs to Kinesis Data Firehose on behalf of the subscriber.
2
Create a CloudWatch Logs destination in the Log Archive account referencing the Kinesis Data Firehose stream and the IAM role.
The destination is registered in the Log Archive account.
This destination acts as the centralized endpoint that member accounts' subscription filters will target.
3
Apply a destination policy to the CloudWatch Logs destination to allow subscription filters from member accounts.
The policy allows logs:PutSubscriptionFilter for principal '*' under the condition that the caller is within the AWS Organization (aws:PrincipalOrgID).
This authorizes member accounts in the organization to create cross-account subscription filters without manually managing individual account numbers in the policy.

Key Concept

Cross-account CloudWatch Logs subscription filters using a centralized destination and destination policy.
Rate this question

Topics

Centralized Monitoring, Logging, and Auditing Solutions

More questions from this topic