Examkin

Question

Difficulty: Very hardMulti-Account Governance and Organizational Structure

An enterprise is designing a secure, multi-account governance strategy using AWS Organizations. The security team wants to delegate CloudTrail administration to a dedicated Security Tooling account. All member accounts must have their API activity logged to a centralized Amazon S3 bucket in the Security Tooling account, encrypted with an AWS KMS Customer Managed Key (CMK). The configuration must be enforced across the organization to prevent member accounts from modifying or bypassing the logging structure.

What is the correct sequence of steps to establish this centralized, secure organization trail using the principle of least privilege in the management account?

  1. 1From the Organizations management account, enable trusted access for AWS CloudTrail.
  2. 2From the Organizations management account, register the Security Tooling account as a delegated administrator for AWS CloudTrail.
  3. 3In the Security Tooling account, create the KMS CMK and the Amazon S3 bucket, configuring their policies to permit the CloudTrail service principal to write logs and encrypt data for the entire organization.
  4. 4From the Security Tooling account, create and configure the organization trail to log to the centralized S3 bucket and use the KMS CMK for encryption.
  5. 5From the Organizations management account, attach a Service Control Policy (SCP) to the organization root preventing member accounts from modifying CloudTrail settings or deleting the logging resources.

Answer

The correct sequence starts by enabling trusted access for CloudTrail from the management account, followed by registering the Security Tooling account as the delegated administrator. Next, the KMS CMK and S3 bucket are created and configured with appropriate resource policies in the Security Tooling account. Then, the organization trail is created from the Security Tooling account. Finally, a Service Control Policy (SCP) is attached from the management account to the organization root to enforce the logging configuration and protect resources from tampering.
The correct sequence begins with enabling trusted access for AWS CloudTrail from the Organizations management account, followed by registering the Security Tooling account as the delegated administrator for CloudTrail. Next, the logging destination (Amazon S3 bucket) and encryption resources (KMS CMK) are created and configured with resource policies in the Security Tooling account to allow CloudTrail access. The organization trail is then created from the Security Tooling account. Finally, an SCP is attached to the organization root from the management account to enforce logging compliance across all member accounts.

Step-by-Step Solution

1
Enable trusted access for AWS CloudTrail from the Organizations management account.
Allows AWS CloudTrail to integrate with AWS Organizations, which is a prerequisite for creating organization-level trails and delegating administration.
Delegated administration and organization-level resources cannot be managed before trusted access is explicitly enabled.
2
Register the Security Tooling account as the delegated administrator for CloudTrail from the management account.
Grants the Security Tooling account permissions to create, update, and delete organization-level trails.
This establishes the delegation of administrative duties, adhering to the security principle of least privilege by reducing the need to access the management account.
3
Create the KMS CMK and Amazon S3 bucket in the Security Tooling account, updating their resource-based policies.
Prepares the storage and encryption infrastructure. The S3 bucket policy must allow 's3:PutObject' for CloudTrail with a condition for the organization ID, and the KMS key policy must allow 'kms:GenerateDataKey*' and 'kms:DescribeKey' for the CloudTrail service principal.
The trail creation will fail if the logging destination (S3) and encryption key (KMS) are not pre-configured to accept logs from the CloudTrail service principal across all accounts.
4
Create the organization trail from the Security Tooling account.
Deploys a multi-region organization trail across all existing and future accounts, sending logs to the central S3 bucket using the KMS key.
Using the delegated administrator permissions, the security team can configure and start the trail without management account access.
5
Attach a Service Control Policy (SCP) at the root level of the organization from the management account.
Restricts member accounts from disabling CloudTrail, modifying the organization trail, or tampering with the S3 bucket and KMS key in the Security Tooling account.
SCPs must be applied to prevent root and administrator users in member accounts from bypassing security logging and auditing controls.

Key Concept

Delegated administration of AWS CloudTrail and centralizing organization-level logging under AWS Organizations governance.
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic