Examkin

Question

Difficulty: MediumSecurity and Compliance Control Design

An enterprise is designing a centralized logging architecture to consolidate AWS CloudTrail logs from all member accounts within an AWS Organization into a single Amazon S3 bucket located in a dedicated Security Account. The organization requires that all logs are encrypted at rest using AWS KMS. Which configuration design correctly establishes the security and compliance controls for this architecture?

  1. Configure the target S3 bucket in the Security Account with a bucket policy that allows the CloudTrail service principal to perform s3:PutObject actions, restricted using the aws:PrincipalOrgID condition. Use a Customer Managed Key (CMK) in the Security Account with a key policy that allows the CloudTrail service principal to perform kms:GenerateDataKey* and kms:DescribeKey operations.Answer
  2. B
    Configure the target S3 bucket in the Security Account with a bucket policy allowing the CloudTrail service principal to write objects. Enable default S3 bucket encryption using the AWS managed key (aws/s3) in the Security Account, and update the key policy to delegate cross-account key usage permissions to all member accounts.
  3. C
    Create a Service Control Policy (SCP) at the Organization root level that explicitly permits s3:PutObject and kms:GenerateDataKey for all member accounts targeting the Security Account's S3 bucket and KMS key, and rely on this SCP to grant access without modifying the target S3 bucket policy or the KMS key policy.
  4. D
    Configure the target S3 bucket policy in the Security Account to grant direct s3:PutObject access to the IAM Admin roles of all member accounts in the organization, and configure CloudTrail in the member accounts to use those IAM roles to write log objects to the central bucket.

Answer

Configure the target S3 bucket in the Security Account with a bucket policy that allows the CloudTrail service principal to perform s3:PutObject actions, restricted using the aws:PrincipalOrgID condition, and use a Customer Managed Key (CMK) in the Security Account with a key policy that allows the CloudTrail service principal to perform kms:GenerateDataKey* and kms:DescribeKey operations.
The correct configuration uses a Customer Managed Key (CMK) in the Security Account, as only CMKs support the key policy edits required to grant cross-account access to the CloudTrail service principal. Additionally, the target S3 bucket policy must explicitly permit the CloudTrail service principal to upload objects, restricted to the organization via the aws:PrincipalOrgID condition.

Step-by-Step Solution

1
Select the correct KMS key type for cross-account S3 encryption.
Choose a Customer Managed Key (CMK) in the Security Account.
AWS-managed keys (like aws/s3) cannot have their policies modified and cannot be accessed or used across accounts.
2
Configure the S3 bucket policy in the central Security Account.
Allow the CloudTrail service principal (cloudtrail.amazonaws.com) to perform s3:PutObject, restricted by the organization ID (aws:PrincipalOrgID).
CloudTrail writes logs via its service principal, so the resource-based S3 bucket policy must trust the principal while restricting access to the specific AWS Organization.
3
Configure the KMS key policy in the central Security Account.
Grant the CloudTrail service principal permissions to perform kms:GenerateDataKey* and kms:DescribeKey.
CloudTrail needs these permissions to generate data keys for encrypting objects before writing them to the bucket.

Key Concept

Cross-account encryption and resource access control for centralized services using Customer Managed Keys (CMKs) and service-principal resource policies.
Estimated Time:2m 0s
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic