Question

Difficulty: Very hardCentralized Monitoring, Logging, and Auditing Solutions

A financial institution uses AWS Organizations to manage 150150 member accounts. The security engineering team is designing a centralized logging and auditing solution. They require all AWS CloudTrail management events from all regions across all accounts to be aggregated into a single Amazon S3 bucket in a dedicated Security account. The architecture must enforce the following requirements:
- All logs must be encrypted at rest using a customer managed key (CMK) in AWS KMS.
- The KMS CMK must be managed within the Security account, and its key policy must enforce least privilege.
- Log integrity validation must be enabled.
- Member account administrators must be blocked from disabling, modifying, or deleting the logging configuration.
- The configuration must scale automatically when new member accounts are added to the organization.

Which of the following configurations meets these requirements while ensuring compliance and operational efficiency?

  1. Create an organization trail from the organization's management account and configure it to deliver logs to the S3 bucket in the Security account. In the Security account, configure the S3 bucket policy to grant s3:GetBucketAcl and s3:PutObject permissions to cloudtrail.amazonaws.com, restricting the write permission to the path corresponding to the Organization ID and requiring the s3:x-amz-acl condition to be bucket-owner-full-control. Create a customer managed KMS key in the Security account with a key policy that allows cloudtrail.amazonaws.com to perform kms:GenerateDataKey* and kms:Decrypt under the condition that the kms:EncryptionContext:aws:cloudtrail:arn matches the organization trail ARN.Answer
  2. B
    Create an organization trail from the organization's management account. Deliver the logs to the S3 bucket in the Security account. In the Security account, configure the S3 bucket policy to grant s3:PutObject to the cloudtrail.amazonaws.com service principal. For encryption, configure CloudTrail to use the default AWS-managed KMS key for Amazon S3 (aws/s3) in the Security account, ensuring all member accounts automatically inherit encryption capabilities without additional key policies.
  3. C
    Create an organization trail in the management account. Deliver logs to the S3 bucket in the Security account. In the Security account, configure a customer managed KMS key. To authorize member accounts to write logs and use the key, create a Service Control Policy (SCP) at the organization's root that allows s3:PutObject and kms:GenerateDataKey* for the cloudtrail.amazonaws.com principal, and attach an IAM policy to each member account administrator role allowing access to the Security account S3 bucket.
  4. D
    Create an organization trail in the management account. Deliver logs to the S3 bucket in the Security account. Configure the S3 bucket policy in the Security account to grant s3:PutObject permissions to the IAM roles and root users of all 150 member accounts. Configure the KMS customer managed key policy to grant kms:GenerateDataKey* permissions to the IAM roles of all member accounts, updating the policy programmatically each time a new member account is created.

Answer

The configuration that uses an organization trail with a customer-managed KMS key in the Security account, configuring the S3 bucket policy and KMS key policy to permit the cloudtrail.amazonaws.com service principal to write logs and generate data keys respectively, while restricting access using the organization ID and trail ARN conditions.
The correct configuration implements an organization trail in the management account to ensure centralization and scalability. The target S3 bucket policy correctly allows the cloudtrail.amazonaws.com service principal to write to the bucket under the bucket owner full control condition. The customer managed KMS key policy grants the cloudtrail.amazonaws.com service principal kms:GenerateDataKey* and kms:Decrypt permissions with a condition that scopes the usage to the specific trail ARN using the encryption context. This setup adheres to least-privilege principles and scales automatically as new accounts are added.

Step-by-Step Solution

1
Establish the logging mechanism using AWS Organizations.
Creating an organization trail in the management account automatically deploys the trail across all regions in all member accounts, including new accounts as they join.
This meets the scalability and administrator restriction requirements, as member accounts cannot modify or delete organization trails.
2
Configure the centralized Amazon S3 bucket policy in the Security account.
The bucket policy allows cloudtrail.amazonaws.com to execute s3:PutObject to the path '/AWSLogs/o-orgid/*' and s3:GetBucketAcl, requiring the 'bucket-owner-full-control' ACL.
This enables CloudTrail to write the log files cross-account while ensuring that the central Security account retains ownership of the delivered logs.
3
Configure the KMS Customer Managed Key (CMK) policy in the Security account.
The key policy allows cloudtrail.amazonaws.com to perform kms:GenerateDataKey* and kms:Decrypt, with a condition verifying that kms:EncryptionContext:aws:cloudtrail:arn matches the organization trail ARN.
This permits CloudTrail to generate the unique data keys needed to encrypt logs per account, while preventing unauthorized entities from using the key.

Key Concept

Centralized multi-account logging with AWS CloudTrail, cross-account S3 bucket policies, and cross-account KMS key policies.
Rate this question