Examkin

Question

Difficulty: MediumCentralized Monitoring, Logging, and Auditing Solutions

A logistics company utilizes AWS Organizations to manage 55 member accounts. The security team requires that all VPC Flow Logs from all VPCs across these member accounts be aggregated into a single, centrally managed Amazon S3 bucket located in a dedicated Security account. The S3 bucket must be encrypted at rest using an encryption key that allows the company to manage key rotation and access policies in compliance with internal security guidelines. The design must adhere to the principle of least privilege.

Which TWO actions must a Solutions Architect take to configure the Amazon S3 bucket and its encryption to support this centralized logging architecture?

  1. Configure the S3 bucket to use an AWS KMS Customer Managed Key (CMK) for encryption, and update the key policy to grant the delivery.logs.amazonaws.com service principal permissions for kms:GenerateDataKey* and kms:Decrypt.Answer
  2. Apply an S3 bucket policy to the central logging bucket that allows the delivery.logs.amazonaws.com service principal to perform s3:PutObject and s3:GetBucketAcl actions.Answer
  3. C
    Configure the central S3 bucket to use the default AWS-managed KMS key (aws/s3) for server-side encryption, as this key automatically trusts and accepts cross-account log delivery requests from within the AWS Organization.
  4. D
    Create an S3 bucket policy that permits s3:PutObject actions where the Principal is set to the IAM roles defined in each member account for publishing VPC Flow Logs.
  5. E
    Apply a Service Control Policy (SCP) at the root of the AWS Organization that grants the s3:PutObject permission on the destination bucket to all accounts in the organization.

Answer

Configure the S3 bucket to use an AWS KMS Customer Managed Key (CMK) and update its policy to allow the log delivery service principal. Additionally, configure the S3 bucket policy to allow the log delivery service principal to write objects and get bucket ACLs.
For cross-account VPC Flow Logs delivery, the logs are written by the AWS Log Delivery service principal (delivery.logs.amazonaws.com). Therefore, the S3 bucket policy in the central security account must explicitly allow this service principal to perform s3:PutObject and s3:GetBucketAcl actions. Furthermore, if KMS encryption is required, an AWS KMS Customer Managed Key (CMK) must be used. The KMS key policy must be updated to allow the delivery.logs.amazonaws.com service principal to run kms:GenerateDataKey* and kms:Decrypt, because the default AWS-managed KMS key (aws/s3) cannot be modified to delegate permissions to this service principal.

Step-by-Step Solution

1
Configure S3 bucket policy in the central Security account
Allows the AWS Log Delivery service principal (delivery.logs.amazonaws.com) to write objects (s3:PutObject) and read the bucket ACL (s3:GetBucketAcl).
Since VPC Flow Logs are delivered directly by the Log Delivery service principal on behalf of the member accounts, the destination S3 bucket policy must explicitly permit this service principal.
2
Set up a Customer Managed Key (CMK) and update its key policy
Enables the Log Delivery service principal to perform kms:GenerateDataKey* and kms:Decrypt operations on the CMK.
AWS-managed KMS keys cannot be shared cross-account or modified to allow service principals to encrypt/decrypt logs. A Customer Managed Key must be used, with its key policy updated to authorize the log delivery service principal.

Key Concept

Cross-account log aggregation for VPC Flow Logs using the Log Delivery service principal, S3 bucket policies, and Customer Managed Keys (CMKs).
Estimated Time:2m 30s
Rate this question

Topics

Centralized Monitoring, Logging, and Auditing Solutions

More questions from this topic