Examkin

Question

Difficulty: MediumCentralized Monitoring, Logging, and Auditing Solutions

A retail corporation manages 7575 member accounts in AWS Organizations. They need to aggregate VPC Flow Logs from all VPCs in all accounts into a single S3 bucket in a dedicated Logging account. The logs must be encrypted at rest using an AWS KMS Customer Managed Key (CMK). The security team requires that the configuration uses the most operationally efficient method and conforms to the principle of least privilege, preventing member accounts from having direct IAM write access to the central S3 bucket.

Which TWO of the following configurations are required to implement this centralized logging solution?

  1. Configure the bucket policy on the centralized S3 bucket in the Logging account to allow the delivery.logs.amazonaws.com service principal to perform s3:PutObject and s3:GetBucketAcl actions, restricted by a condition matching the AWS Organization ID.Answer
  2. Configure the key policy of the Customer Managed Key (CMK) in the Logging account to grant the delivery.logs.amazonaws.com service principal kms:GenerateDataKey* permissions, restricted by a condition matching the AWS Organization ID.Answer
  3. C
    Enable default S3 bucket encryption using the AWS-managed KMS key for S3 (aws/s3), and apply a Service Control Policy (SCP) at the Organization root that allows cross-account access to this key for all member accounts.
  4. D
    Configure an IAM role in each member account with permissions to write to the central S3 bucket, and configure VPC Flow Logs in each member account to assume this IAM role when delivering logs.
  5. E
    Share the central S3 bucket using AWS Resource Access Manager (RAM) with the entire AWS Organization, allowing member accounts to directly select the shared bucket as the destination when creating VPC Flow Logs.

Answer

Configure the bucket policy on the centralized S3 bucket to allow the delivery.logs.amazonaws.com service principal to perform s3:PutObject and s3:GetBucketAcl actions restricted by the AWS Organization ID, and configure the key policy of the Customer Managed Key (CMK) to grant the delivery.logs.amazonaws.com service principal kms:GenerateDataKey* permissions restricted by the AWS Organization ID.
The correct solution involves configuring the centralized S3 bucket policy to allow the delivery.logs.amazonaws.com service principal to execute s3:PutObject and s3:GetBucketAcl actions, while also configuring the Customer Managed Key (CMK) key policy to allow the same service principal to execute kms:GenerateDataKey* actions. Both policies should be restricted to the AWS Organization ID using the aws:PrincipalOrgID condition. This setup ensures that the native log delivery service can write encrypted logs to the central bucket on behalf of all accounts within the organization without needing IAM roles or compromising the principle of least privilege.

Step-by-Step Solution

1
Analyze the log delivery mechanism for VPC Flow Logs to S3.
Identify that VPC Flow Logs writes to S3 using the delivery.logs.amazonaws.com service principal.
This establishes that permissions must be granted to this service principal in the destination account's S3 bucket policy and KMS key policy rather than through cross-account IAM roles or AWS Resource Access Manager.
2
Evaluate S3 bucket policy requirements.
Determine that the central logging S3 bucket policy must allow s3:PutObject and s3:GetBucketAcl for delivery.logs.amazonaws.com, restricted by the aws:PrincipalOrgID condition.
This ensures that only member accounts belonging to the organization can successfully deliver logs to the central bucket, satisfying the security and least-privilege constraints.
3
Evaluate KMS CMK key policy requirements.
Determine that because a CMK is used for S3 bucket encryption, the delivery.logs.amazonaws.com service principal requires kms:GenerateDataKey* permissions in the CMK key policy, restricted by the aws:PrincipalOrgID condition.
The delivery service must be able to generate data keys to encrypt the log objects before writing them to the bucket. Using an AWS-managed key (aws/s3) is not possible since its policy cannot be modified for cross-account access.

Key Concept

Cross-account VPC Flow Logs delivery to a centralized S3 bucket encrypted with a KMS CMK requires granting permissions to the delivery.logs.amazonaws.com service principal in both the S3 bucket policy and the KMS key policy.
Rate this question

Topics

Centralized Monitoring, Logging, and Auditing Solutions

More questions from this topic