Examkin

Question

Difficulty: HardEnhancing Data Protection and Compliance

A financial services company is enhancing data protection and compliance across its multi-account AWS environment managed via AWS Organizations. A solutions architect must design a centralized logging solution to consolidate AWS CloudTrail logs from all member accounts into a single Amazon S3 bucket located in a dedicated Security account. The logs must be encrypted at rest using a custom key with automatic rotation, and the solution must guarantee that the logs cannot be tampered with or deleted by unauthorized administrators in the member accounts. Which of the following actions should the solutions architect take to implement this securely? (Select TWO.)

  1. In the Security account, create an Amazon S3 bucket and a Customer Managed Key (CMK). Configure the KMS key policy to grant the AWS CloudTrail service principal permission to perform kms:GenerateDataKey* and kms:Decrypt operations, and restrict access using the aws:SourceArn condition pointing to the organization's management account trail.Answer
  2. Configure the S3 bucket policy in the Security account to grant s3:GetBucketAcl and s3:PutObject permissions to the AWS CloudTrail service principal, using the aws:SourceArn condition to restrict writes to the organization's trail. Enable log file integrity validation on the trail.Answer
  3. C
    Encrypt the S3 bucket in the Security account using the default AWS-managed key for Amazon S3 (aws/s3). Configure the key policy of aws/s3 to allow the CloudTrail service principal and member account IAM roles to perform encryption and decryption operations.
  4. D
    Create a Service Control Policy (SCP) at the root level of AWS Organizations that explicitly allows the CloudTrail service principal to access the S3 bucket and KMS keys across all accounts, thereby bypassing local key policy and bucket policy requirements for member accounts.
  5. E
    Configure the S3 bucket policy in the Security account to grant s3:PutObject permissions to * with a condition specifying aws:PrincipalOrgID matching the organization's ID. This allows all member account IAM entities to write logs directly to the bucket without needing service principal permissions.

Answer

Configure a Customer Managed Key (CMK) in the Security account with a key policy allowing CloudTrail permissions, restricted by aws:SourceArn, and configure the Security account's S3 bucket policy to permit CloudTrail's service principal to write logs using the same organization-focused resource restriction while enabling log file integrity validation.
Creating a Customer Managed Key (CMK) allows customizing the key policy to support cross-account service principal permissions. The CloudTrail service principal requires kms:GenerateDataKey* and kms:Decrypt permissions to write and validate encrypted logs. The S3 bucket policy must grant s3:GetBucketAcl and s3:PutObject permissions to the CloudTrail service principal, with security reinforced using the aws:SourceArn condition to limit log delivery to the specific organization-level trail.

Step-by-Step Solution

1
Identify the key management requirements for cross-account S3 encryption.
Determine that a Customer Managed Key (CMK) is required because AWS-managed keys (aws/s3) do not allow policy modifications to grant cross-account or service-specific permissions.
This eliminates options proposing AWS-managed keys.
2
Verify the permission model for AWS CloudTrail log delivery to S3.
Establish that CloudTrail uses the service principal 'cloudtrail.amazonaws.com' to write logs, requiring explicit permissions in both the S3 bucket policy and the KMS key policy.
This invalidates options using IAM-based organizational constraints like aws:PrincipalOrgID for bucket writes.
3
Evaluate the role of AWS Organizations guardrails versus resource-based policies.
Determine that Service Control Policies (SCPs) are filters and do not grant permissions or override the need for proper key policies or S3 bucket policies.
This ensures the correct configuration includes both a customized KMS key policy and a matching S3 bucket policy.

Key Concept

Centralized, secure cross-account logging requires custom KMS keys (CMKs) and service principal permissions under resource-based policies to ensure proper encryption and integrity validation.
Rate this question

Topics

Enhancing Data Protection and Compliance