Examkin

Question

Difficulty: MediumCentralized Monitoring, Logging, and Auditing Solutions

An enterprise operates a multi-account environment within AWS Organizations consisting of 80 member accounts. The security team requires all AWS CloudTrail API activity logs to be consolidated into a single Amazon S3 bucket located in a dedicated Security account. The logs must be encrypted at rest using a customer managed key (KMS CMK) to comply with regulatory standards. The solution must also prevent member accounts from modifying or disabling the logging configuration. Which TWO actions must the solutions architect perform to implement this solution?

  1. Create a multi-region organization trail from the organization's management account that delivers logs to the S3 bucket in the Security account, and configure a key policy on a customer managed KMS key in the Security account that grants the AWS CloudTrail service principal permissions to perform the kms:GenerateDataKey* and kms:Decrypt actions.Answer
  2. Configure the S3 bucket policy in the Security account to allow s3:PutObject and s3:GetBucketAcl actions for the AWS CloudTrail service principal, specifying the organization's management account ID in the S3 resource path and applying a condition that matches the AWS Organization ID.Answer
  3. C
    Enable default encryption on the centralized S3 bucket using the AWS-managed KMS key (aws/s3) in the Security account, and configure the key policy of aws/s3 to allow cross-account access for the CloudTrail service principal.
  4. D
    Attach a Service Control Policy (SCP) to the organization root that explicitly grants s3:PutObject permissions to all member accounts, allowing local IAM roles to write log files directly to the centralized S3 bucket.
  5. E
    Configure the S3 bucket policy in the Security account to grant read and write access to all member accounts by using a wildcard principal (*) and relying on AWS Resource Access Manager (RAM) to share the bucket with the organization.

Answer

Create a multi-region organization trail from the organization's management account that delivers logs to the S3 bucket in the Security account, configure a key policy on a customer managed KMS key in the Security account that grants the AWS CloudTrail service principal permissions to perform the kms:GenerateDataKey* and kms:Decrypt actions, and configure the S3 bucket policy in the Security account to allow s3:PutObject and s3:GetBucketAcl actions for the AWS CloudTrail service principal under the organization ID condition.
To implement centralized CloudTrail logging across an AWS Organization, a multi-region organization trail must be created from the management account. This trail consolidates logs in the target S3 bucket and prevents member accounts from tampering with the configuration. The target S3 bucket policy must explicitly permit the CloudTrail service principal to perform write operations, and the customer managed KMS key policy must authorize CloudTrail to perform cryptographic actions for log encryption.

Step-by-Step Solution

1
Configure the centralized S3 bucket in the Security account.
An S3 bucket is created with a bucket policy allowing 'cloudtrail.amazonaws.com' to call s3:PutObject and s3:GetBucketAcl, restricted to the organization ID.
This establishes a secure, cross-account log destination for all member accounts within the AWS Organization.
2
Set up encryption using a customer managed key.
A customer managed KMS key (CMK) is created with a key policy allowing 'cloudtrail.amazonaws.com' to generate data keys and decrypt.
AWS CloudTrail requires explicit KMS key policy permissions on customer managed keys to encrypt logs delivered to an S3 bucket in a different account.
3
Deploy the organization-wide CloudTrail configuration.
A multi-region organization trail is created from the management account.
An organization trail automatically applies to all member accounts, consolidates API logging centrally, and prevents member accounts from modifying the trail.

Key Concept

Centralized Monitoring, Logging, and Auditing Solutions
Estimated Time:3m 0s
Rate this question

Topics

Centralized Monitoring, Logging, and Auditing Solutions

More questions from this topic