Examkin

Question

Difficulty: Very hardMulti-Account Governance and Organizational Structure

A multinational financial services company is designing a multi-account governance strategy using AWS Organizations. The security team has designated a dedicated Security tooling account to aggregate AWS CloudTrail logs from all member accounts. The architecture requires that:
1. CloudTrail logs from all accounts must be encrypted using an AWS KMS key.
2. The logs must be stored in a centralized Amazon S3 bucket within the Security tooling account.
3. Individual member accounts must not be able to modify, delete, or read the logs once written.
4. The management of the Organization's CloudTrail configurations must be delegated to the Security tooling account to adhere to the principle of least privilege for the management account.
5. All operations must minimize administrative overhead.

Which of the following configurations meets these requirements while minimizing administrative overhead?

  1. A
    Configure the S3 bucket policy in the Security tooling account to allow s3:PutObject permissions to a wildcard principal (*) while relying on a Service Control Policy (SCP) attached to the Organization root to restrict writing to only the organization's member accounts. Use the AWS-managed KMS key aws/s3 for log encryption to avoid managing custom KMS key policies, and enable CloudTrail in each member account individually.
  2. B
    Configure AWS CloudTrail delegated administration in the management account, designating the Security tooling account. Create a centralized S3 bucket in the Security tooling account. Use the AWS-managed KMS key aws/cloudtrail to encrypt the logs to minimize custom key management, and configure the S3 bucket policy to allow the CloudTrail service principal to write logs. Create an organization-level trail from the delegated administrator account.
  3. Register the Security tooling account as a delegated administrator for AWS CloudTrail in the management account. In the Security tooling account, create a centralized S3 bucket and a symmetric customer managed KMS key. Configure the S3 bucket policy to permit the cloudtrail.amazonaws.com service principal to write objects, restricted by a condition for the Organization ID. Configure the KMS key policy to permit the cloudtrail.amazonaws.com service principal to generate data keys, restricted by the same Organization ID condition. Create an organization trail from the delegated administrator account to write to the centralized S3 bucket and encrypt with the customer managed KMS key.Answer
  4. D
    Create a Service Control Policy (SCP) that grants the cloudtrail.amazonaws.com service principal the authority to write to the centralized S3 bucket in the Security tooling account, and attach this SCP to the Organization root. In the member accounts, configure local IAM policies to allow CloudTrail to write to the S3 bucket, and use the default AWS-managed KMS key aws/s3 for encryption.

Answer

Registering the Security tooling account as a delegated administrator for AWS CloudTrail, using a centralized S3 bucket with a bucket policy restricted by Organization ID, and encrypting with a customer managed KMS key containing a key policy that trusts the CloudTrail service principal restricted by the Organization ID.
Registering a delegated administrator for AWS CloudTrail allows the Security tooling account to manage logging configuration for the entire organization without accessing the management account, supporting least privilege. In cross-account logging scenarios, using a customer managed KMS key is mandatory because AWS-managed keys (like aws/s3 or aws/cloudtrail) cannot have their key policies modified to allow cross-account access. The S3 bucket policy and KMS key policy must explicitly trust the cloudtrail.amazonaws.com service principal and enforce organizational boundaries using the aws:PrincipalOrgID condition key to prevent unauthorized access.

Step-by-Step Solution

1
Register the Security tooling account as a delegated administrator for AWS CloudTrail.
The Security tooling account is authorized to manage Organization-level trails.
Enables central governance and adheres to least privilege by keeping the management account clear of day-to-day operations.
2
Create a centralized S3 bucket in the Security tooling account and configure its bucket policy.
A secure S3 bucket is created with a policy allowing the CloudTrail service principal to write logs.
Resource-based S3 policies must explicitly allow cross-account writes from the CloudTrail service principal, restricted by the AWS Organization ID to prevent external uploads.
3
Create and configure a symmetric customer managed KMS key in the Security tooling account.
A KMS key is created with a key policy allowing the CloudTrail service principal to perform key generation actions.
AWS-managed KMS keys cannot be shared across accounts or have their policies modified. A customer managed KMS key is required to allow cross-account encryption by CloudTrail.
4
Create an Organization Trail from the delegated administrator account.
An organization trail is established that automatically logs all member accounts.
A single organization trail reduces administrative overhead compared to configuring individual trails per account.

Key Concept

Delegated administration, customer managed KMS key policy management, and resource-based policies for cross-account logging in AWS Organizations.
Estimated Time:3m 0s
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic