Examkin

Question

Difficulty: MediumCentralized Monitoring, Logging, and Auditing Solutions

A logistics corporation manages 3030 AWS accounts under a single organization in AWS Organizations. The security team needs to implement centralized aggregation of VPC Flow Logs from all VPCs in all member accounts into a single, highly secure Amazon S3 bucket located in a dedicated Security account. The solution must ensure that log transmission is encrypted in transit and at rest using a Customer Managed Key (CMK) in AWS Key Management Service (AWS KMS), and that member accounts cannot delete or modify the centralized logs or the logging configurations. Which TWO configurations must the solutions architect implement to achieve these requirements?

  1. Create an Amazon S3 bucket in the Security account. Configure the S3 bucket policy to allow the delivery.logs.amazonaws.com service principal to perform s3:PutObject operations.Answer
  2. Create a customer managed key (CMK) in the Security account. Configure the KMS key policy to grant the delivery.logs.amazonaws.com service principal permission to perform kms:GenerateDataKey operations, and enable S3 Bucket Key on the destination S3 bucket.Answer
  3. C
    Configure the VPC Flow Logs in the member accounts to encrypt the logs at rest using the AWS-managed key for Amazon S3 (aws/s3) located in the Security account.
  4. D
    Create an S3 bucket policy in the Security account that grants write access to the AWSServiceRoleForVPCDelivery service-linked role from each member account.
  5. E
    Apply a Service Control Policy (SCP) at the Organization root that grants s3:PutObject and kms:GenerateDataKey permissions to the member accounts to authorize log delivery to the Security account.

Answer

Create an S3 bucket in the Security account and configure its bucket policy to allow the delivery.logs.amazonaws.com service principal to perform s3:PutObject operations, and create a customer managed key in the Security account with a policy that allows the delivery.logs.amazonaws.com service principal to perform kms:GenerateDataKey operations.
Centralized VPC Flow Logs delivery to S3 requires S3 bucket policies to allow the delivery.logs.amazonaws.com service principal to write objects. If encryption is required using a Customer Managed Key, the key policy must also authorize the delivery.logs.amazonaws.com service principal to generate data keys.

Step-by-Step Solution

1
Configure the S3 bucket policy in the destination Security account.
Allows the VPC Flow Logs service principal (delivery.logs.amazonaws.com) to write log objects into the bucket.
Since the logs are delivered across accounts, resource-based policies must authorize the delivery service principal.
2
Configure a Customer Managed Key (CMK) in the Security account with a key policy authorizing the delivery service.
Enables the delivery.logs.amazonaws.com service principal to request data keys (kms:GenerateDataKey) to encrypt objects delivered to S3.
AWS-managed keys cannot be shared cross-account or configured with custom resource policies to authorize external service principals.

Key Concept

Cross-account centralized VPC Flow Logs delivery requires configuring S3 bucket policies and Customer Managed KMS key policies to authorize the delivery.logs.amazonaws.com service principal.
Estimated Time:1m 30s
Rate this question

Topics

Centralized Monitoring, Logging, and Auditing Solutions

More questions from this topic