Examkin

Question

Difficulty: MediumCentralized Monitoring, Logging, and Auditing Solutions

A biotech research organization uses AWS Organizations to manage 120120 member accounts. A Solutions Architect is designing a centralized logging and auditing solution. The solution must collect AWS CloudTrail logs from all current and future member accounts and store them in a single Amazon S3 bucket located in a dedicated Security account. The logs must be encrypted at rest using a customer managed key (CMK) in AWS KMS to comply with strict industry regulations. The configuration must prevent member accounts from disabling log collection or deleting the logs, while minimizing administrative overhead.

Which TWO configurations should the Solutions Architect implement to meet these requirements? (Select TWO.)

  1. In the Security account, configure the S3 bucket policy to allow the `cloudtrail.amazonaws.com` service principal to perform `s3:GetBucketAcl` and `s3:PutObject` operations, restricting access to the organization using the `aws:PrincipalOrgID` condition key.Answer
  2. In the Security account, create a customer managed KMS key. Configure the KMS key policy to allow the `cloudtrail.amazonaws.com` service principal to perform `kms:GenerateDataKey*` and `kms:DescribeKey` operations, using the `aws:PrincipalOrgID` condition key to restrict access to the organization.Answer
  3. C
    In the Security account, configure the S3 bucket to use the default AWS-managed KMS key (`aws/s3`) for encryption, and update the key policy to allow cross-account access for the `cloudtrail.amazonaws.com` service principal across the organization.
  4. D
    In the Security account, configure the S3 bucket policy to allow the IAM execution roles of each member account to perform `s3:PutObject` operations to deliver the log files.
  5. E
    Create a Service Control Policy (SCP) that grants the `s3:PutObject` permission on the Security account's S3 bucket to all member accounts, and attach the SCP to the Organization root to enable log delivery without modifying the S3 bucket policy.

Answer

Configure the S3 bucket policy in the Security account to allow the CloudTrail service principal to perform `s3:GetBucketAcl` and `s3:PutObject` operations under the condition that the organization matches the target Org ID. Additionally, create a customer managed KMS key in the Security account and configure its key policy to allow the CloudTrail service principal to perform `kms:GenerateDataKey*` and `kms:DescribeKey` operations restricted by the same organization ID condition.
For centralized logging using AWS CloudTrail across multiple accounts in AWS Organizations, the destination S3 bucket policy must allow the `cloudtrail.amazonaws.com` service principal to write objects and retrieve bucket ACLs, restricted to the organization ID. When logs are encrypted with a KMS key, the key must be a Customer Managed Key (CMK) because default AWS-managed keys cannot be shared cross-account or have their policies edited. The customer managed KMS key policy must authorize the CloudTrail service principal to generate data keys and describe the key, matching the organization's ID to allow secure cross-account log delivery.

Step-by-Step Solution

1
Configure the destination S3 bucket policy in the dedicated Security account.
The bucket policy allows the `cloudtrail.amazonaws.com` service principal to execute `s3:GetBucketAcl` and `s3:PutObject` actions, restricted to the organization's ID using the `aws:PrincipalOrgID` condition key.
This setup allows CloudTrail trails in member accounts to deliver log files to the central bucket securely without exposing the bucket to external entities.
2
Set up a Customer Managed Key (CMK) in AWS KMS within the Security account.
A customer managed KMS key is created and configured with a key policy allowing the `cloudtrail.amazonaws.com` service principal to use `kms:GenerateDataKey*` and `kms:DescribeKey` under the `aws:PrincipalOrgID` condition.
AWS-managed KMS keys (like `aws/s3`) cannot be shared across accounts or have their key policies edited, which prevents CloudTrail from performing cross-account encryption.

Key Concept

Centralized cross-account logging with AWS CloudTrail, S3 bucket policies, and AWS KMS Customer Managed Keys.
Estimated Time:2m 0s
Rate this question

Topics

Centralized Monitoring, Logging, and Auditing Solutions

More questions from this topic