A financial institution uses AWS Organizations to manage member accounts. The security engineering team is designing a centralized logging and auditing solution. They require all AWS CloudTrail management events from all regions across all accounts to be aggregated into a single Amazon S3 bucket in a dedicated Security account. The architecture must enforce the following requirements:
- All logs must be encrypted at rest using a customer managed key (CMK) in AWS KMS.
- The KMS CMK must be managed within the Security account, and its key policy must enforce least privilege.
- Log integrity validation must be enabled.
- Member account administrators must be blocked from disabling, modifying, or deleting the logging configuration.
- The configuration must scale automatically when new member accounts are added to the organization.
Which of the following configurations meets these requirements while ensuring compliance and operational efficiency?
- Create an organization trail from the organization's management account and configure it to deliver logs to the S3 bucket in the Security account. In the Security account, configure the S3 bucket policy to grant s3:GetBucketAcl and s3:PutObject permissions to cloudtrail.amazonaws.com, restricting the write permission to the path corresponding to the Organization ID and requiring the s3:x-amz-acl condition to be bucket-owner-full-control. Create a customer managed KMS key in the Security account with a key policy that allows cloudtrail.amazonaws.com to perform kms:GenerateDataKey* and kms:Decrypt under the condition that the kms:EncryptionContext:aws:cloudtrail:arn matches the organization trail ARN.Answer
- BCreate an organization trail from the organization's management account. Deliver the logs to the S3 bucket in the Security account. In the Security account, configure the S3 bucket policy to grant s3:PutObject to the cloudtrail.amazonaws.com service principal. For encryption, configure CloudTrail to use the default AWS-managed KMS key for Amazon S3 (aws/s3) in the Security account, ensuring all member accounts automatically inherit encryption capabilities without additional key policies.
- CCreate an organization trail in the management account. Deliver logs to the S3 bucket in the Security account. In the Security account, configure a customer managed KMS key. To authorize member accounts to write logs and use the key, create a Service Control Policy (SCP) at the organization's root that allows s3:PutObject and kms:GenerateDataKey* for the cloudtrail.amazonaws.com principal, and attach an IAM policy to each member account administrator role allowing access to the Security account S3 bucket.
- DCreate an organization trail in the management account. Deliver logs to the S3 bucket in the Security account. Configure the S3 bucket policy in the Security account to grant s3:PutObject permissions to the IAM roles and root users of all 150 member accounts. Configure the KMS customer managed key policy to grant kms:GenerateDataKey* permissions to the IAM roles of all member accounts, updating the policy programmatically each time a new member account is created.