Examkin

Question

Difficulty: HardMulti-Account Governance and Organizational Structure

An enterprise is designing a secure governance framework for its AWS Organizations structure, which consists of multiple organizational units (OUs) and a dedicated centralized Logging account. To comply with regulatory standards, a solutions architect must establish an organizational CloudTrail that logs all API activity across all member accounts. The architecture must adhere to the principle of least privilege by avoiding the use of the Management account for daily auditing tasks, and it must prevent any modifications or deletions of logging resources by member accounts.

What is the correct sequence of steps to configure this centralized, secure auditing solution?

  1. 1From the Organizations management account, enable trusted access for CloudTrail and register the Security Audit account as the delegated administrator.
  2. 2In the central Logging account, create an Amazon S3 bucket and a KMS customer managed key, configuring their policies to allow the CloudTrail service principal to write logs and use the key for the entire organization.
  3. 3From the Security Audit account, create an organization-wide CloudTrail that targets the S3 bucket in the central Logging account and encrypts logs with the KMS customer managed key.
  4. 4From the Organizations management account, attach a Service Control Policy (SCP) to the organization root to deny member accounts the permission to disable, modify, or delete the organizational trail.

Answer

Register the Security Audit account as the delegated administrator for CloudTrail from the Organizations management account, configure the S3 bucket and KMS key resource policies in the Logging account, create the organizational trail from the Security Audit account, and then apply the Service Control Policy from the management account to the organization root.
The correct order begins with registering the Security Audit account as the delegated administrator for AWS CloudTrail from the management account. Next, the target resources (Amazon S3 bucket and KMS customer managed key) must be created and their resource policies configured in the central Logging account. This is mandatory before trail creation because CloudTrail validates the destination policies upon setup. The organizational trail is then created from the newly registered delegated administrator account. Finally, a Service Control Policy is attached to the organization root from the management account to prevent any member accounts from disabling or modifying the trail.

Step-by-Step Solution

1
Enable CloudTrail trusted access and register the Security Audit account as the delegated administrator from the Organizations management account.
The Security Audit account is authorized to create and manage organizational trails.
Security principles dictate delegating operations away from the management account, but only the management account holds the authority to perform this registration.
2
Create the Amazon S3 bucket and KMS customer managed key in the centralized Logging account, and update their policies to allow CloudTrail service principal access.
A secure, centralized storage location is prepared to receive and encrypt organization-wide logs.
CloudTrail validates destination S3 bucket permissions and KMS key accessibility at the time of trail creation. If these are not configured first, the trail setup will fail.
3
Create the organization-wide CloudTrail from the Security Audit account, linking it to the destination S3 bucket and KMS key.
The organizational trail starts collecting and delivering logs from all accounts to the central S3 bucket.
This establishes the active auditing mechanism across the entire Organization using the delegated administrator permissions.
4
Attach a Service Control Policy (SCP) at the Organization root from the management account.
Member accounts are blocked from disabling, modifying, or deleting the organizational trail.
This finalizes the governance structure by ensuring the audit baseline cannot be compromised by member account administrators.

Key Concept

Delegated Administration and Centralized Resource Control in AWS Organizations
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic