Examkin

Question

Difficulty: EasyCentralized Monitoring, Logging, and Auditing Solutions

An enterprise uses AWS Organizations with fifty member accounts. To meet regulatory requirements, all AWS CloudTrail logs from these accounts must be consolidated into a single Amazon S3 bucket within a centralized Log Archive account. The logs must be encrypted at rest using AWS KMS. The security team requires that the KMS key supports cross-account decryption by security analysts.

Which of the following actions must the solutions architect take to satisfy these requirements?

  1. Configure the organization trail to write to the S3 bucket in the Log Archive account. Use a customer managed KMS key in the Log Archive account with a key policy that grants kms:GenerateDataKey* and kms:Decrypt permissions to the CloudTrail service principal, and update the S3 bucket policy to allow the CloudTrail service principal to perform s3:PutObject operations.Answer
  2. B
    Configure the organization trail to use the default AWS-managed KMS key (aws/cloudtrail) in the Log Archive account, because it automatically allows cross-account log encryption and decryption.
  3. C
    Apply a Service Control Policy (SCP) to the organization root that allows member accounts to directly write to the central S3 bucket, removing the need to configure a cross-account S3 bucket policy on the destination bucket.
  4. D
    Configure the central S3 bucket policy to grant s3:PutObject permissions directly to the IAM root user of each member account, rather than the CloudTrail service principal.

Answer

Configure the organization trail to write to the S3 bucket in the Log Archive account. Use a customer managed KMS key in the Log Archive account with a key policy that grants permissions to the CloudTrail service principal, and update the S3 bucket policy to allow the CloudTrail service principal to perform write operations.
The correct configuration utilizes an organization trail that delivers logs to a centralized S3 bucket. Because AWS-managed KMS keys cannot be shared across accounts, a customer managed key must be used. The key policy must allow the CloudTrail service principal to generate data keys and decrypt them, and the S3 bucket policy must allow the CloudTrail service principal to write objects.

Step-by-Step Solution

1
Configure the destination S3 bucket in the Log Archive account.
The bucket is ready to receive logs but requires a bucket policy to allow writes from external accounts.
Since CloudTrail will write logs from multiple member accounts, a resource-based policy must trust the CloudTrail service principal.
2
Create and configure a Customer Managed Key (CMK) in AWS KMS in the Log Archive account.
A key is generated that can have its key policy modified.
AWS-managed keys (like aws/cloudtrail) cannot be shared across accounts. A customer managed key allows customizing the key policy to trust the CloudTrail service principal for encryption (GenerateDataKey) and security analysts for decryption.
3
Deploy the organization trail to aggregate logs from all member accounts.
CloudTrail automatically creates trails in all member accounts and begins sending encrypted logs to the centralized bucket.
An organization trail ensures uniform audit logging across all current and future accounts in the organization.

Key Concept

Centralized cross-account logging requires S3 bucket policies and Customer Managed KMS keys configured for cross-account access, as AWS-managed keys cannot be shared across account boundaries.
Rate this question

Topics

Centralized Monitoring, Logging, and Auditing Solutions

More questions from this topic