Examkin

Question

Difficulty: Very hardImproving Operational Excellence via Monitoring and Logging

An enterprise manages a multi-account environment using AWS Organizations. The transaction workloads run on Amazon ECS on AWS Fargate across several member accounts, with application containers sending log events to local Amazon CloudWatch log groups. To comply with security audits, the enterprise must aggregate all member account AWS CloudTrail trails into a centralized Amazon S3 bucket in a dedicated security account. Additionally, all application logs must be streamed in real-time to an Amazon OpenSearch Service domain located in the security account. Currently, cross-account CloudTrail logs are failing to deliver to the S3 bucket, and application logs remain isolated within their local member accounts. Which combination of actions will securely centralize both the CloudTrail logs and the application logs with the least operational overhead? (Select TWO.)

  1. In the security account, configure the centralized S3 bucket policy to allow the `s3:PutObject` action for the `cloudtrail.amazonaws.com` service principal, and include a condition that checks `aws:PrincipalOrgID` to match the enterprise's Organization ID.Answer
  2. B
    In the security account, configure the S3 bucket policy to grant `s3:PutObject` directly to the root IAM ARNs of all member accounts, and enable default bucket encryption using the AWS-managed KMS key `aws/s3` while granting the member accounts cross-account access to the key.
  3. In the security account, create an Amazon Kinesis Data Stream and a CloudWatch Logs destination pointing to it. Configure the destination's access policy to allow `logs:PutSubscriptionFilter` from the Organization, and create an IAM role trusted by `logs.amazonaws.com` to write to the stream. In the member accounts, create CloudWatch Logs subscription filters targeting the centralized destination.Answer
  4. D
    In the security account, modify the S3 bucket policy to allow `s3:PutObject` only to the parent AWS Organization's root account ID, and in the member accounts, update the CloudTrail trail configuration to use the S3 bucket's regional endpoint directly without the `cloudtrail.amazonaws.com` service principal in the bucket policy.
  5. E
    In the member accounts, configure the CloudWatch agent on the Fargate tasks to ship logs directly to the security account's S3 bucket by modifying the agent's configuration file to use static log file paths. Associate an IAM role with the task execution role that has a trust relationship allowing the security account's root user to write objects to the S3 bucket.

Answer

The correct options are configuring the S3 bucket policy in the security account to trust the CloudTrail service principal with an Organization ID condition, and establishing a cross-account CloudWatch Logs subscription filter topology targeting an Amazon Kinesis Data Stream in the security account.
Configuring the centralized S3 bucket policy in the security account to trust the CloudTrail service principal with an Organization ID condition ensures that CloudTrail can successfully write logs from all present and future member accounts securely. Establishing a CloudWatch Logs destination in the security account backed by Kinesis Data Streams allows member accounts to use native subscription filters to stream container logs across accounts efficiently, without embedding credentials or managing complex agent configurations.

Step-by-Step Solution

1
Configure centralized S3 bucket policy for CloudTrail.
The S3 bucket policy in the security account allows `s3:PutObject` for the service principal `cloudtrail.amazonaws.com` and utilizes the `aws:PrincipalOrgID` condition.
This enables secure, cross-account log delivery from all Organization member accounts without listing individual account IDs.
2
Set up centralized CloudWatch Logs ingestion target in the security account.
An Amazon Kinesis Data Stream is created, and a CloudWatch Logs destination is associated with it, protected by an access policy allowing the Organization's member accounts to write to it.
This establishes a secure endpoint in the security account that can receive logs from other accounts.
3
Configure subscription filters in member accounts.
CloudWatch Logs subscription filters in the member accounts target the centralized destination ARN in the security account.
This routes the local container logs in real time across accounts to the centralized Kinesis Data Stream, which then feeds the OpenSearch domain.

Key Concept

Cross-account log aggregation using S3 bucket policies for CloudTrail and CloudWatch Logs subscription destinations for real-time application log ingestion.
Rate this question

Topics

Improving Operational Excellence via Monitoring and Logging