Examkin

Question

Difficulty: Very hardCentralized Monitoring, Logging, and Auditing Solutions

A multinational financial services company uses AWS Organizations with 400 member accounts. The security team is designing a centralized monitoring and auditing solution. They require all regional AWS CloudTrail logs to be aggregated into a single Amazon S3 bucket within a dedicated Log Archive account. The logs must be encrypted at rest using a customer managed KMS key. The configuration must enforce least privilege, prevent unauthorized modification of trails within member accounts, and ensure uninterrupted log delivery. Which combination of S3 bucket policy, KMS key configuration, and Service Control Policy (SCP) satisfies these requirements while preventing log delivery failures?

  1. A
    Deploy an AWS Organizations organization trail in the management account that logs to a central Amazon S3 bucket in the Log Archive account. Configure default bucket encryption using the AWS-managed KMS key for Amazon S3 (aws/s3). Update the S3 bucket policy to grant s3:PutObject permissions to the cloudtrail.amazonaws.com service principal with a condition on aws:PrincipalOrgID. Apply a Service Control Policy (SCP) at the organization root that denies cloudtrail:StopLogging, cloudtrail:UpdateTrail, and cloudtrail:DeleteTrail actions.
  2. B
    Deploy an AWS Organizations organization trail in the management account that logs to a central Amazon S3 bucket in the Log Archive account. In the Log Archive account, configure a customer managed KMS key. Attach a Service Control Policy (SCP) to the organization root that explicitly allows s3:PutObject to the central S3 bucket and kms:GenerateDataKey* to the central KMS key for all member accounts, and denies cloudtrail:StopLogging, cloudtrail:UpdateTrail, and cloudtrail:DeleteTrail actions.
  3. Deploy an AWS Organizations organization trail in the management account that logs to a central Amazon S3 bucket in the Log Archive account. In the Log Archive account, configure a customer managed KMS key with a key policy that allows the cloudtrail.amazonaws.com service principal to execute kms:GenerateDataKey* and kms:DescribeKey with a condition restricting the source ARN to the trail. Update the S3 bucket policy to grant s3:PutObject permissions to the cloudtrail.amazonaws.com service principal with a condition on aws:PrincipalOrgID. Apply a Service Control Policy (SCP) at the organization root that denies cloudtrail:StopLogging, cloudtrail:UpdateTrail, and cloudtrail:DeleteTrail actions.Answer
  4. D
    Deploy an AWS Organizations organization trail in the management account that logs to a central Amazon S3 bucket in the Log Archive account. In the Log Archive account, configure a customer managed KMS key and update its key policy to allow the cloudtrail.amazonaws.com service principal to execute kms:GenerateDataKey* and kms:DescribeKey. Configure the S3 bucket policy to grant read and write access to the IAM roles within the management account only, assuming the organization trail writes logs using the management account's credentials. Apply a Service Control Policy (SCP) at the organization root that denies cloudtrail:StopLogging, cloudtrail:UpdateTrail, and cloudtrail:DeleteTrail actions.

Answer

The correct solution deploys an organization trail in the management account delivering logs to a central S3 bucket in the Log Archive account. The Log Archive account uses a customer managed KMS key with key policies permitting the CloudTrail service principal to generate data keys and describe the key, scoped to the trail's ARN. The S3 bucket policy permits the CloudTrail service principal to write objects scoped by the organization ID. Lastly, a Service Control Policy restricts member accounts from modifying or stopping CloudTrail logging.
The correct solution properly aligns cross-account S3 bucket policies and customer managed KMS key policies to trust the CloudTrail service principal (cloudtrail.amazonaws.com) using the organization's ID and trail ARN as conditions. It also leverages an SCP as a preventive guardrail to enforce logging integrity without misinterpreting it as an access-granting policy.

Step-by-Step Solution

1
Deploy an organization-wide trail in the AWS Organizations management account.
Logs from all accounts within the organization are automatically collected and aggregated.
This centralizes auditing without requiring local configurations in each individual member account.
2
Configure the S3 bucket policy in the Log Archive account to permit writes from the CloudTrail service principal.
The bucket policy allows cloudtrail.amazonaws.com to execute s3:PutObject, restricted to the organization ID.
Ensures that cross-account CloudTrail log delivery is permitted only for accounts within the specified AWS Organization.
3
Create and configure a customer managed KMS key policy in the Log Archive account.
The key policy allows the CloudTrail service principal to perform kms:GenerateDataKey* and kms:DescribeKey with an aws:SourceArn condition.
Allows CloudTrail to encrypt the logs before writing them to S3. AWS-managed keys cannot be shared cross-account, necessitating a customer managed key.
4
Apply a Service Control Policy (SCP) at the organization root.
Actions like cloudtrail:StopLogging, cloudtrail:UpdateTrail, and cloudtrail:DeleteTrail are denied for all member accounts.
Prevents member account administrators from tampering with or disabling the centralized audit logging.

Key Concept

Centralized cross-account logging requires resource-based policy alignment (S3 bucket policy and KMS key policy) allowing the service principal, while SCPs enforce logging compliance at the organization boundary.
Estimated Time:3m 0s
Rate this question

Topics

Centralized Monitoring, Logging, and Auditing Solutions

More questions from this topic