Examkin

Question

Difficulty: HardEnhancing Data Protection and Compliance

A financial services organization has implemented a multi-account structure using AWS Organizations. The security team is auditing the existing architecture to enhance data protection and compliance. They want to centralize Amazon S3 bucket access logs and AWS CloudTrail logs from all member accounts into a single secure S3 bucket in a dedicated Security account. All logs must be encrypted at rest using Server-Side Encryption with AWS KMS (SSE-KMS). Member accounts must be prevented from disabling logging, modifying the central S3 bucket configuration, or deleting the KMS encryption keys. Which two actions should the solutions architect take to meet these requirements?

  1. Configure the S3 bucket policy in the Security account to grant write permissions (s3:PutObject) to the AWS CloudTrail service principal, restricting access to the Organization by using the aws:PrincipalOrgID condition key.Answer
  2. B
    Utilize the AWS-managed KMS key for Amazon S3 (aws/s3) in the Security account to encrypt the logs, and modify the key policy of aws/s3 to grant encryption and decryption permissions to the member accounts.
  3. Create a Customer Managed Key (CMK) in the Security account, configure its key policy to allow cross-account usage from the member accounts, and apply a Service Control Policy (SCP) at the Organization root to deny member accounts from performing kms:ScheduleKeyDeletion or kms:PutKeyPolicy on this key.Answer
  4. D
    Attach a Service Control Policy (SCP) to the member account Organizational Units (OUs) that grants the IAM roles in member accounts write permissions to the central S3 bucket in the Security account.
  5. E
    Configure the S3 bucket policy in the Security account to allow log delivery, but omit the Principal element in the policy statement under the assumption that the AWS Organizations trust relationship handles cross-account resource authorization.

Answer

To meet the requirements, the solutions architect must configure the centralized S3 bucket policy in the Security account to grant write permissions to the CloudTrail service principal while restricting access to the organization using the organization ID condition. Additionally, a Customer Managed Key (CMK) must be created in the Security account with a cross-account key policy, and a Service Control Policy (SCP) must be applied to prevent member accounts from deleting or modifying the key.
To achieve compliance and security, the solutions architect must configure a bucket policy on the centralized S3 bucket in the Security account that explicitly allows the CloudTrail service principal to write logs, restricted to the organization using the aws:PrincipalOrgID condition. Since AWS-managed keys cannot be shared across accounts, a Customer Managed Key (CMK) must be created in the Security account with a key policy allowing member accounts to use it. A Service Control Policy (SCP) at the organization level is then used to prevent member accounts from modifying or deleting this key, satisfying the security requirements.

Step-by-Step Solution

1
Configure the central S3 bucket policy in the Security account.
Allows the CloudTrail service principal (cloudtrail.amazonaws.com) to call s3:PutObject with a condition limiting the source to the specific Organization ID using the aws:PrincipalOrgID key.
Ensures that all member accounts in the Organization can securely deliver their logs to the centralized bucket while blocking unauthorized accounts.
2
Create and configure a Customer Managed Key (CMK) in the Security account.
The CMK is configured with a key policy that grants kms:GenerateDataKey* and kms:Decrypt permissions to the member accounts' IAM roles or services.
AWS-managed keys (like aws/s3) cannot be shared across accounts or customized, so a Customer Managed Key is required to support cross-account log encryption.
3
Apply a Service Control Policy (SCP) at the Organization level.
Prevents member accounts from deleting the logging CMK or altering key policies, while allowing authorized log writing and reading functions.
Ensures compliance and protects data integrity by establishing administrative guardrails that member account administrators cannot bypass.

Key Concept

Implementing secure centralized logging across multiple AWS accounts using S3 bucket policies with organizational conditions, customer-managed KMS keys for cross-account encryption, and Service Control Policies as compliance guardrails.
Rate this question

Topics

Enhancing Data Protection and Compliance