Examkin

Question

Difficulty: HardCentralized Monitoring, Logging, and Auditing Solutions

An enterprise with 8585 member accounts managed under a single organization in AWS Organizations is setting up a centralized logging architecture. The solutions architect is configuring an organization-wide AWS CloudTrail trail to deliver log files to a single Amazon S3 bucket located in a dedicated Log Archive account. To satisfy security policies, all logs must be encrypted at rest using an AWS KMS Customer Managed Key (CMK) managed by the security team, and member account administrators must not be able to disable the trail or modify the logging configurations. Which TWO configurations are required to establish this architecture? (Select TWO.)

  1. In the Log Archive account, configure the S3 bucket policy to allow the cloudtrail.amazonaws.com service principal to perform s3:PutObject actions, using the aws:PrincipalOrgID condition key to restrict write access to the organization.Answer
  2. Configure the KMS key policy for the Customer Managed Key to allow the cloudtrail.amazonaws.com service principal to perform kms:GenerateDataKey* and kms:DescribeKey operations, using the aws:SourceArn condition to restrict access to the organization's trails.Answer
  3. C
    Enable encryption on the centralized S3 bucket using the default AWS-managed KMS key (aws/s3) and configure a cross-account IAM policy in the member accounts to grant the CloudTrail service principal permissions to use this key.
  4. D
    Configure the S3 bucket policy in the Log Archive account to grant the administrator IAM roles of individual member accounts the s3:PutObject permission to allow them to deliver the CloudTrail logs.
  5. E
    Attach a Service Control Policy (SCP) to the organization's root that explicitly grants cloudtrail:StartLogging and kms:GenerateDataKey permissions to all member accounts to authorize the delivery of encrypted logs.

Answer

In the Log Archive account, the S3 bucket policy must allow the CloudTrail service principal to perform s3:PutObject actions restricted by the organization ID, and the KMS Customer Managed Key policy must allow the CloudTrail service principal to generate data keys and describe the key restricted by the trail ARN.
The correct solution involves configuring the S3 bucket policy to allow the CloudTrail service principal to write logs using the aws:PrincipalOrgID condition to secure the bucket across the entire organization. Additionally, since the requirements specify using a Customer Managed Key, the key policy must explicitly allow the CloudTrail service principal to generate data keys and describe the key to encrypt the files upon delivery.

Step-by-Step Solution

1
Analyze the log delivery mechanism for AWS CloudTrail.
Determine that logs are delivered by the cloudtrail.amazonaws.com service principal directly, not by local IAM users or roles in member accounts.
This establishes that permissions must be granted to the service principal in both S3 bucket policies and KMS key policies.
2
Configure S3 bucket access control.
Implement an S3 bucket policy in the Log Archive account allowing the CloudTrail service principal to put objects, constrained by the aws:PrincipalOrgID condition to restrict access to the organization.
This prevents unauthorized accounts outside the organization from writing to the centralized bucket while allowing all member accounts to do so.
3
Configure KMS encryption permissions.
Define a key policy for the Customer Managed Key (CMK) that permits the CloudTrail service principal to perform kms:GenerateDataKey* and kms:DescribeKey actions.
AWS-managed KMS keys do not support cross-account sharing or key policy updates, so a Customer Managed Key is required. The key policy must explicitly authorize CloudTrail to generate data keys for file encryption.

Key Concept

Centralized Monitoring, Logging, and Auditing Solutions
Rate this question

Topics

Centralized Monitoring, Logging, and Auditing Solutions

More questions from this topic