Examkin

Question

Difficulty: MediumCentralized Monitoring, Logging, and Auditing Solutions

A retail enterprise manages 150150 member accounts within an organization in AWS Organizations. The security team requires that all VPC Flow Logs from all VPCs in all member accounts be centralized into a single Amazon S3 bucket located in a dedicated Logging account. To comply with security policies, all logs must be encrypted at rest using a customer managed KMS key, and the data transfer must not utilize intermediate CloudWatch log groups in the member accounts. Which configuration should the Solutions Architect implement in the central Logging account to enable successful delivery of the VPC Flow Logs?

  1. A
    Configure the S3 bucket policy to grant s3:PutObject and s3:GetBucketAcl permissions to the S3 Log Delivery service principal (delivery.logs.amazonaws.com). Configure the S3 bucket to use the AWS-managed key for Amazon S3 (aws/s3) for encryption.
  2. Configure the S3 bucket policy to grant s3:PutObject and s3:GetBucketAcl permissions to the S3 Log Delivery service principal (delivery.logs.amazonaws.com). Configure the KMS key policy of the customer managed key to grant kms:GenerateDataKey* and kms:Decrypt permissions to the same service principal.Answer
  3. C
    Configure the S3 bucket policy to grant s3:PutObject permissions to the IAM root principal of each member account. Configure the KMS key policy of the customer managed key to grant kms:GenerateDataKey* and kms:Decrypt permissions to the IAM root principal of each member account.
  4. D
    Create a Service Control Policy (SCP) at the organization root that allows the s3:PutObject and kms:GenerateDataKey* actions for all member accounts. Attach this SCP to the Organizational Units (OUs) containing the member accounts.

Answer

Configure the S3 bucket policy to grant s3:PutObject and s3:GetBucketAcl permissions to the S3 Log Delivery service principal (delivery.logs.amazonaws.com). Configure the KMS key policy of the customer managed key to grant kms:GenerateDataKey* and kms:Decrypt permissions to the same service principal.
The correct configuration grants bucket access and KMS key access directly to the S3 Log Delivery service principal (delivery.logs.amazonaws.com). Since VPC Flow Logs bypass CloudWatch and write directly to S3, the delivery service acts as the writer. Since the destination bucket is in a different account, a customer managed KMS key is required because AWS-managed keys (like aws/s3) do not allow modification of their key policies to trust external service principals or accounts.

Step-by-Step Solution

1
Determine the service principal responsible for log delivery.
The service principal is identified as delivery.logs.amazonaws.com.
VPC Flow Logs delivered directly to S3 are written by the S3 Log Delivery service principal rather than the member accounts' IAM roles.
2
Configure the resource-based policy on the target S3 bucket.
The S3 bucket policy permits s3:PutObject and s3:GetBucketAcl for delivery.logs.amazonaws.com.
The service principal must have permission to verify bucket ownership and write flow log objects.
3
Configure permissions for bucket encryption.
A customer managed KMS key is selected, and its key policy is updated to grant kms:GenerateDataKey* and kms:Decrypt to delivery.logs.amazonaws.com.
AWS-managed KMS keys (like aws/s3) cannot be shared across accounts. A customer managed key allows the key policy to be customized to permit the Log Delivery service principal to generate data keys and decrypt them for log writes.

Key Concept

Cross-account VPC Flow Logs centralization with custom KMS encryption
Rate this question

Topics

Centralized Monitoring, Logging, and Auditing Solutions

More questions from this topic