Examkin

Question

Difficulty: HardCentralized Monitoring, Logging, and Auditing Solutions

A global e-commerce enterprise uses AWS Organizations to manage 85 member accounts. The security team requires a centralized auditing solution that aggregates AWS CloudTrail management and data events across all AWS regions into a single Amazon S3 bucket located in a dedicated Auditing account. The architecture must ensure that all logs are encrypted at rest using a Customer Managed Key (CMK) created in the Auditing account. The configuration must be enforced globally, preventing member account administrators from bypassing or modifying the log delivery. Which combination of configurations is required to establish this architecture? (Select TWO.)

  1. From the AWS Organizations management account, create an organization trail that is configured to deliver logs to the centralized S3 bucket in the Auditing account and specifies the Customer Managed Key (CMK) in the Auditing account for encryption.Answer
  2. In the Auditing account, update the S3 bucket policy to grant s3:PutObject permissions to the CloudTrail service principal, and update the KMS key policy to grant kms:GenerateDataKey* permissions to the CloudTrail service principal, both restricted by the aws:PrincipalOrgID condition matching the organization's ID.Answer
  3. C
    In the Auditing account, configure the S3 bucket policy to allow the root principal of each member account to perform s3:PutObject, and configure an IAM role in each member account that allows the CloudTrail service to assume it.
  4. D
    Apply a Service Control Policy (SCP) at the AWS Organizations root level that grants s3:PutObject and kms:GenerateDataKey* permissions directly to the CloudTrail service principal across all member accounts.
  5. E
    In the Auditing account, configure the central S3 bucket to use the default AWS-managed KMS key (aws/s3) for server-side encryption, and add a bucket policy that grants the CloudTrail service principal read and write access.

Answer

To establish a centralized, secure auditing solution, the organization trail must be created from the AWS Organizations management account, pointing to the S3 bucket and KMS CMK in the Auditing account. The Auditing account must configure the S3 bucket policy to allow the CloudTrail service principal to write logs and update the KMS CMK key policy to allow the CloudTrail service principal to generate data keys, restricting both resources using the organization ID condition.
The correct solution involves creating an organization trail from the Organizations management account, ensuring that log generation is immutable for member account admins. The centralized resources (S3 bucket and KMS CMK) reside in a dedicated Auditing account, which must trust the CloudTrail service principal. By modifying the S3 bucket policy and the KMS key policy in the Auditing account to permit access to the CloudTrail service principal, and constraining it with the organization's ID condition key, logs can be securely consolidated and encrypted across all member accounts without granting overly broad access.

Step-by-Step Solution

1
Create the Organization Trail
An organization trail is established from the management account, which automatically logs events across all member accounts and regions, delivering them centrally.
Creating the trail at the organization level enforces logging across all current and future member accounts and prevents member account administrators from disabling or modifying the trail.
2
Configure Centralized S3 Bucket Access
The S3 bucket in the Auditing account accepts log files written by the CloudTrail service.
Since log delivery is a cross-account action, the destination S3 bucket must have a policy allowing the CloudTrail service principal to put objects, secured with the organization ID condition to ensure isolation.
3
Configure KMS Key Policy for Encryption
The KMS CMK in the Auditing account allows CloudTrail to request data keys to encrypt logs at rest.
AWS CloudTrail requires permissions to generate data keys using the specified CMK. The key policy must explicitly allow the CloudTrail service principal to perform this action, restricted to the organization ID.

Key Concept

Cross-Account Centralized Log Aggregation using AWS Organizations Trails and Custom KMS Encryption
Rate this question

Topics

Centralized Monitoring, Logging, and Auditing Solutions

More questions from this topic