Examkin

Question

Difficulty: HardCentralized Monitoring, Logging, and Auditing Solutions

A global retail group manages 135135 AWS accounts within an AWS Organization. To comply with strict regulatory audit requirements, a solutions architect must establish an organization-wide AWS CloudTrail trail that delivers log files from all AWS Regions to a centralized Amazon S3 bucket located in a dedicated Auditing account. The organization requires that the logs be encrypted at rest using an AWS Key Management Service (AWS KMS) key. The security team dictates that member accounts must not have permissions to decrypt the CloudTrail logs once written, nor should they be able to disable the logging configuration. Which combination of configuration steps will satisfy these requirements?

  1. Create the Amazon S3 bucket and a KMS customer managed key (CMK) in the Auditing account. Configure the S3 bucket policy to allow the CloudTrail service principal to perform s3:PutObject and s3:GetBucketAcl operations, restricted by the aws:PrincipalOrgID condition. Configure the KMS key policy to allow the CloudTrail service principal to perform kms:GenerateDataKey* and kms:DescribeKey operations, restricted by the aws:PrincipalOrgID condition. Create an organization trail in the management account that points to the centralized S3 bucket and uses the Auditing account CMK. Apply a Service Control Policy (SCP) to the organization root that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, and cloudtrail:UpdateTrail actions.Answer
  2. B
    Create the Amazon S3 bucket in the Auditing account. Configure the S3 bucket policy to allow the CloudTrail service principal to perform s3:PutObject and s3:GetBucketAcl operations, restricted by the aws:PrincipalOrgID condition. Configure the organization trail to encrypt logs using the default AWS-managed KMS key for CloudTrail (aws/cloudtrail) in the Auditing account. Create an organization trail in the management account that points to the centralized S3 bucket. Apply a Service Control Policy (SCP) to the organization root that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, and cloudtrail:UpdateTrail actions.
  3. C
    Create the Amazon S3 bucket and a KMS customer managed key (CMK) in the Auditing account. Create a unique IAM role in each of the 135135 member accounts with permissions to put objects in the Auditing account S3 bucket and generate data keys using the CMK. Configure CloudTrail in each member account individually to assume this local IAM role for log delivery, pointing to the centralized S3 bucket. Apply a Service Control Policy (SCP) to the organization root that denies the delete and disable actions on CloudTrail.
  4. D
    Create the Amazon S3 bucket and a KMS customer managed key (CMK) in the Auditing account. In the Auditing account, configure the S3 bucket policy and the KMS key policy to trust the organization management account. Apply a Service Control Policy (SCP) to the organization root that explicitly allows the CloudTrail service principal to perform s3:PutObject, kms:GenerateDataKey*, and kms:DescribeKey actions across all accounts, while denying member accounts access to modify CloudTrail configurations.

Answer

Create the Amazon S3 bucket and a Customer Managed Key (CMK) in the Auditing account, configure both resource policies to allow the CloudTrail service principal with an Organization ID constraint, deploy an organization-wide trail, and enforce logging with a Service Control Policy (SCP) at the root.
The correct option correctly uses a Customer Managed Key (CMK) in the Auditing account, which supports modifying the key policy to allow cross-account access by the CloudTrail service principal. Both the S3 bucket policy and the KMS key policy correctly authorize the cloudtrail.amazonaws.com service principal with a condition checking the organization's ID (aws:PrincipalOrgID). The organization trail ensures all accounts are covered, and the SCP prevents member accounts from modifying the logging configuration without attempting to grant access itself.

Step-by-Step Solution

1
Set up centralized storage and encryption resources in the Auditing account.
An S3 bucket is created to store logs, and a KMS Customer Managed Key (CMK) is provisioned to encrypt the logs.
Centralizing logs in a dedicated account isolates audit data from member accounts, and a CMK allows policy modifications necessary for cross-account service principal access.
2
Configure the S3 bucket policy and KMS key policy to permit cross-account CloudTrail delivery.
The S3 bucket policy allows the CloudTrail service principal to write objects, and the KMS key policy allows it to generate data keys, both restricted to the specific organization using the aws:PrincipalOrgID condition.
CloudTrail operates under its own service principal rather than member IAM roles, requiring resource-based policies to permit delivery while restricting access to the specified organization.
3
Create an organization-wide trail from the management account and apply a Service Control Policy (SCP) to protect the configuration.
An organization trail is deployed to capture all events across all regions and member accounts, and an SCP is attached to the organization root to deny delete, stop, or update trail actions.
An organization trail ensures uniform and secure log collection, while the SCP prevents member accounts (including root users) from altering or disabling the audit logging.

Key Concept

Centralized multi-account logging requires resource-based policies on S3 and KMS CMKs that explicitly trust the CloudTrail service principal, combined with organization-wide trails and SCP guardrails to prevent tampering.
Rate this question

Topics

Centralized Monitoring, Logging, and Auditing Solutions

More questions from this topic