An enterprise manages AWS accounts within an AWS Organization and is designing a centralized auditing architecture. A Solutions Architect must configure an AWS CloudTrail organization trail that aggregates all API activity logs into a single Amazon S3 bucket located in a dedicated log archive account. All logs must be encrypted at rest using a customer managed AWS KMS key. Which TWO configuration steps must the Solutions Architect perform to implement this solution? (Select TWO.)
- Configure the S3 bucket policy in the log archive account to allow the cloudtrail.amazonaws.com service principal to perform s3:PutObject actions, restricted to the prefix AWSLogs/o-xxxxxxxxx/ where o-xxxxxxxxx is the Organization ID.Answer
- Configure the KMS key policy in the log archive account to grant kms:GenerateDataKey* and kms:DescribeKey permissions to the cloudtrail.amazonaws.com service principal, with a condition checking that aws:PrincipalOrgID matches the Organization ID.Answer
- CConfigure the organization trail to encrypt logs using the AWS-managed KMS key (aws/s3) in the log archive account to avoid the administrative overhead of managing custom key policies.
- DCreate an S3 bucket policy in the log archive account that grants s3:PutObject permissions to the individual AWS account root principals of all 200 member accounts to authorize local log uploads.
- ECreate a Service Control Policy (SCP) at the root level of the organization that explicitly grants the s3:PutObject action to the cloudtrail.amazonaws.com principal for the centralized S3 bucket.
Answer
To establish a centralized, encrypted logging architecture, the Solutions Architect must configure the S3 bucket policy in the log archive account to allow the CloudTrail service principal to write to the prefix matching the Organization ID, and configure the customer managed KMS key policy to grant the CloudTrail service principal permissions for key generation and description, restricted by the Organization ID.
To configure an organization trail delivering logs to a centralized S3 bucket in a log archive account, the S3 bucket policy must explicitly permit the CloudTrail service principal to write logs under the organization's prefix. Additionally, when using SSE-KMS with a customer managed key, the KMS key policy must grant permissions to the CloudTrail service principal for generating data keys and describing the key, restricted to the organization using the aws:PrincipalOrgID condition key. This ensures secure, cross-account log delivery and encryption.
Step-by-Step Solution
Key Concept
Centralized cross-account logging using AWS CloudTrail organization trails, requiring S3 resource-based bucket policies and customer managed KMS key policies for encryption.