Examkin

Question

Difficulty: Very hardMulti-Account Governance and Organizational Structure

A multinational enterprise is designing a centralized logging architecture across its AWS Organizations structure, which consists of over 200 member accounts. A solutions architect is setting up an organization-wide AWS CloudTrail trail that delivers log files to a single Amazon S3 bucket located in a dedicated Security account. The log files must be encrypted using AWS Key Management Service (AWS KMS).

The solutions architect needs to configure the S3 bucket policy and the KMS key policy in the Security account to allow CloudTrail to write logs and encrypt them, ensuring that the configurations scale dynamically as new accounts are added or removed from the organization.

Which combination of configurations will meet these requirements? (Select TWO.)

  1. Configure the Amazon S3 bucket policy in the Security account to grant s3:PutObject permissions to the cloudtrail.amazonaws.com service principal, restricting the resource path to arn:aws:s3:::my-central-bucket/AWSLogs/o-organizationid/*, and requiring the s3:x-amz-acl condition to be set to bucket-owner-full-control.Answer
  2. Create a Customer Managed Key (CMK) in the Security account and configure its key policy to grant the cloudtrail.amazonaws.com service principal kms:GenerateDataKey* and kms:Decrypt permissions, restricted by a condition that evaluates kms:EncryptionContext:aws:cloudtrail:arn against the organization trail ARN.Answer
  3. C
    Configure the Amazon S3 bucket policy in the Security account to grant s3:PutObject permissions to the principal arn:aws:iam::*:root for all accounts in the organization by using the aws:PrincipalOrgID condition.
  4. D
    Configure the organization trail to use the default AWS-managed KMS key (aws/cloudtrail) in the management account, and update its key policy to allow cross-account access for all member accounts within the organization.
  5. E
    Attach a Service Control Policy (SCP) to the organization root that grants the cloudtrail.amazonaws.com service principal permission to assume the default OrganizationAccountAccessRole in the Security account to write logs.

Answer

Configure the S3 bucket policy to allow the CloudTrail service principal using the organization ID in the path and requiring the bucket-owner-full-control ACL, and create a Customer Managed Key (CMK) in the Security account with a key policy allowing the CloudTrail service principal to generate data keys and decrypt logs restricted by the trail's encryption context.
The correct configurations are the ones that configure the Amazon S3 bucket policy to allow the CloudTrail service principal to perform s3:PutObject using the Organization ID prefix and a requirement for bucket-owner-full-control ACL, along with configuring a Customer Managed Key policy to allow the CloudTrail service principal to perform kms:GenerateDataKey* and kms:Decrypt constrained by the trail's encryption context ARN. The S3 bucket policy dynamically scales using the Organization ID path without hardcoding individual accounts, and requiring the bucket-owner-full-control ACL guarantees that the central account owns the written objects. Using a Customer Managed Key is required because AWS-managed KMS keys cannot be shared cross-account, and restricting it via the encryption context ensures only the designated organization trail can utilize the key.

Step-by-Step Solution

1
Identify the writer of the log files in an organization trail.
Determine that the writer is the AWS CloudTrail service principal (cloudtrail.amazonaws.com), not the individual member accounts.
Bucket policies must grant write permissions directly to the CloudTrail service principal.
2
Design the S3 bucket policy path for scalability.
Use the prefix AWSLogs/o-organizationid/* to dynamically cover all member accounts within the organization without listing them individually.
Hardcoding over 200 account IDs is not operationally efficient and will exceed bucket policy size limits.
3
Address KMS encryption requirements for cross-account log delivery.
Create a Customer Managed Key (CMK) because the default AWS-managed KMS key (aws/cloudtrail or aws/s3) cannot be shared across accounts due to non-modifiable policies.
Member accounts need permissions to use the KMS key when writing logs, which is only possible via a Customer Managed Key policy.
4
Secure the KMS key by restricting its usage context.
Add a policy condition that validates kms:EncryptionContext:aws:cloudtrail:arn against the specific organization trail ARN.
Prevents unauthorized accounts outside the organization or unauthorized trails from utilizing the KMS key.

Key Concept

Cross-account centralized logging using AWS CloudTrail and AWS KMS in a multi-account organization structure.
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic