Examkin

Question

Difficulty: Very hardCentralized Monitoring, Logging, and Auditing Solutions

An enterprise manages 200200 AWS accounts under a single organization in AWS Organizations. The Chief Information Security Officer (CISO) requires a centralized logging solution that records all AWS API activity across all member accounts. The logs must be consolidated into a centralized Amazon S3 bucket within a dedicated Log Archive account.

The design must satisfy the following strict security and operational constraints:
- All log files must be encrypted at rest using a Customer Managed Key (CMK) in AWS KMS managed by the Log Archive account.
- Member accounts must have no permission to modify or disable the logging configuration, nor should they have direct access to read or decrypt the centralized logs.
- The S3 bucket and KMS CMK policies must restrict access using the principle of least privilege, preventing unauthorized AWS accounts from writing logs or using the KMS key.

Which set of configurations should a solutions architect implement to meet these requirements?

  1. Create the S3 bucket and a KMS CMK in the Log Archive account. Configure the KMS key policy to allow the cloudtrail.amazonaws.com principal to perform kms:GenerateDataKey* and kms:DescribeKey actions, with a condition matching the organization's ID using the aws:PrincipalOrgID key. Configure the S3 bucket policy to allow the cloudtrail.amazonaws.com principal to perform s3:GetBucketAcl and s3:PutObject actions, restricted to the organization's ID using the aws:PrincipalOrgID condition. In the AWS Organizations management account, create an organization trail configured to send logs to the centralized S3 bucket and encrypt them using the KMS CMK. Apply a Service Control Policy (SCP) to the organization's root that denies cloudtrail:DeleteTrail, cloudtrail:StopLogging, and cloudtrail:UpdateTrail actions for all member accounts.Answer
  2. B
    Create the S3 bucket in the Log Archive account. In the AWS Organizations management account, create an organization trail configured to send logs to the centralized S3 bucket and encrypt them using the default AWS-managed key for Amazon S3 (aws/s3). Configure the S3 bucket policy to allow the cloudtrail.amazonaws.com principal to perform s3:GetBucketAcl and s3:PutObject actions, restricted to the organization's ID using the aws:PrincipalOrgID condition. Apply a Service Control Policy (SCP) to the organization's root that denies cloudtrail:DeleteTrail, cloudtrail:StopLogging, and cloudtrail:UpdateTrail actions for all member accounts.
  3. C
    Create the S3 bucket and a KMS CMK in the Log Archive account. Configure the KMS key policy to allow the cloudtrail.amazonaws.com principal to perform kms:GenerateDataKey* and kms:DescribeKey actions. Configure the S3 bucket policy to allow the cloudtrail.amazonaws.com principal to perform s3:GetBucketAcl and s3:PutObject actions, restricted to the organization's ID using the aws:PrincipalOrgID condition. Attach a Service Control Policy (SCP) to the organization's root that explicitly allows cloudtrail:CreateTrail, s3:PutObject, and kms:GenerateDataKey* to all member accounts to authorize local log delivery. Create local trails in each member account pointing to the centralized S3 bucket.
  4. D
    Create the S3 bucket and a KMS CMK in the Log Archive account. Configure the KMS key policy to allow the cloudtrail.amazonaws.com principal to perform kms:GenerateDataKey* and kms:DescribeKey actions. Configure the S3 bucket policy to allow the root principals (arn:aws:iam::<member_account_id>:root) of all member accounts in the organization to perform s3:PutObject and s3:GetBucketAcl actions. In the AWS Organizations management account, create an organization trail configured to send logs to the centralized S3 bucket and encrypt them using the KMS CMK. Apply a Service Control Policy (SCP) to the organization's root that denies cloudtrail:DeleteTrail, cloudtrail:StopLogging, and cloudtrail:UpdateTrail actions.

Answer

Create the S3 bucket and a KMS CMK in the Log Archive account, configure the KMS key policy and S3 bucket policy to grant necessary permissions to the cloudtrail.amazonaws.com service principal with the aws:PrincipalOrgID condition, create the organization trail in the management account, and restrict trail modifications in member accounts via an SCP.
The correct solution involves creating an organization trail in the management account, which guarantees that all API activity is logged across all accounts and cannot be modified by local users. By creating a Customer Managed Key (CMK) in the Log Archive account, the policy can be updated to delegate cross-account access to the CloudTrail service principal. Restricting S3 bucket access and KMS key usage to the cloudtrail.amazonaws.com principal with the aws:PrincipalOrgID condition key aligns with the principle of least privilege, ensuring that only trails within the specified organization can deliver logs and generate keys.

Step-by-Step Solution

1
Configure S3 bucket and KMS CMK policies in the Log Archive account.
Resource policies are established to allow the cloudtrail.amazonaws.com service principal to write logs and generate data keys, restricted to the organization via the aws:PrincipalOrgID condition.
CloudTrail requires explicit permissions (s3:GetBucketAcl, s3:PutObject, kms:GenerateDataKey*, kms:DescribeKey) to deliver logs to a centralized S3 bucket and encrypt them using a cross-account KMS CMK.
2
Deploy an organization trail from the Organizations management account.
A centralized, organization-wide trail is created that automatically captures and consolidated events across all member accounts.
An organization trail ensures that management events from all current and future member accounts are logged in a standardized, tamper-resistant manner.
3
Implement a Service Control Policy (SCP) to protect the trail configuration.
SCPs restrict member accounts from stopping, updating, or deleting CloudTrail resources.
SCPs act as authorization guardrails, ensuring that local administrators in member accounts cannot disable logging or tamper with the organization trail configuration.

Key Concept

Cross-account AWS CloudTrail logging requires a Customer Managed Key (CMK) and resource-based policies that grant the CloudTrail service principal access, coupled with organizational Service Control Policies (SCPs) to act as configuration guardrails.
Estimated Time:3m 0s
Rate this question

Topics

Centralized Monitoring, Logging, and Auditing Solutions

More questions from this topic