A media streaming company manages a multi-account environment containing AWS accounts under a single AWS Organization. The security operations team requires all VPC Flow Logs from all member accounts to be consolidated into a single Amazon S3 bucket located in a dedicated Security account. The logs must be encrypted at rest using a customer managed key (CMK) in AWS Key Management Service (AWS KMS) to satisfy compliance guidelines. The solution must minimize administrative overhead and enforce least privilege.
Which TWO configurations must a Solutions Architect implement to achieve this goal?
- In the Security account, configure the S3 bucket policy to grant s3:PutObject and s3:GetBucketAcl permissions to the delivery.logs.amazonaws.com service principal, and restrict access using the aws:PrincipalOrgID condition key.Answer
- In the Security account, configure the KMS key policy for the customer managed key to grant kms:GenerateDataKey* and kms:Decrypt permissions to the delivery.logs.amazonaws.com service principal, and restrict access using the aws:PrincipalOrgID condition key.Answer
- CIn the Security account, configure the S3 bucket policy to grant s3:PutObject permissions to the IAM roles or root principals of the member accounts using the aws:PrincipalOrgID condition key.
- DEnable Amazon S3 default encryption on the centralized bucket using the AWS managed key (aws/s3), and configure the S3 bucket policy to allow cross-account access.
- ECreate and apply a Service Control Policy (SCP) at the organization root that grants s3:PutObject and kms:GenerateDataKey* permissions to the member accounts for the centralized bucket resource.
Answer
The correct configurations are: configuring the S3 bucket policy in the Security account to grant permission to the log delivery service principal, and configuring the customer managed KMS key policy to grant the log delivery service principal permission to use the key, both restricted by the Organization ID.
To centralize VPC Flow Logs to an S3 bucket in a different account, the S3 Log Delivery service principal (delivery.logs.amazonaws.com) requires permissions to write the logs. The S3 bucket policy must allow s3:PutObject and s3:GetBucketAcl for this service principal, restricted by the AWS Organization ID using the aws:PrincipalOrgID condition. Additionally, if the bucket is encrypted with a KMS customer managed key (CMK), the KMS key policy must grant kms:GenerateDataKey* and kms:Decrypt to the same service principal, also restricted by the Organization ID, because AWS managed keys (aws/s3) cannot be shared across accounts.
Step-by-Step Solution
Key Concept
Centralized VPC Flow Logs ingestion using S3 Log Delivery and KMS Customer Managed Keys in a multi-account AWS Organization.