Examkin

Question

Difficulty: MediumAWS CloudTrail Configuration and Management

A SysOps Administrator is configuring a new AWS CloudTrail trail to deliver log files to an Amazon S3 bucket. The trail is configured to encrypt the log files using a customer managed key in AWS Key Management Service (AWS KMS). However, the administrator notices that log files are not appearing in the S3 bucket, and CloudTrail reports delivery errors.

Which of the following actions must the administrator take to allow CloudTrail to successfully deliver the encrypted log files? (Select two.)

  1. Configure the Amazon S3 bucket policy to grant the AWS CloudTrail service principal (cloudtrail.amazonaws.com) the s3:PutObject permission for the target log prefix.Answer
  2. Configure the KMS key policy to grant the AWS CloudTrail service principal (cloudtrail.amazonaws.com) the kms:GenerateDataKey* and kms:DescribeKey permissions.Answer
  3. C
    Add a policy statement to the KMS key policy that allows the Amazon S3 service principal (s3.amazonaws.com) to perform kms:GenerateDataKey* and kms:Decrypt actions.
  4. D
    Attach an IAM policy to the administrator's IAM identity granting the iam:PassRole permission to pass the KMS key to the CloudTrail service.

Answer

To resolve the delivery issues, the SysOps Administrator must configure the Amazon S3 bucket policy to grant the AWS CloudTrail service principal (cloudtrail.amazonaws.com) the s3:PutObject permission, and configure the KMS key policy to grant the AWS CloudTrail service principal the kms:GenerateDataKey* and kms:DescribeKey permissions.
To successfully deliver encrypted logs, CloudTrail must have permissions on both the destination S3 bucket and the custom KMS key. The S3 bucket policy must allow the CloudTrail service principal to upload logs via the s3:PutObject action. Simultaneously, since CloudTrail encrypts the logs before delivery, the KMS key policy must grant the CloudTrail service principal the kms:GenerateDataKey* and kms:DescribeKey permissions.

Step-by-Step Solution

1
Analyze the resource dependencies for AWS CloudTrail log delivery using KMS encryption.
Identify that CloudTrail writes log files directly to the destination Amazon S3 bucket and encrypts them using the specified KMS key before delivery.
Understanding the components involved in the write and encryption path identifies which policies need correction.
2
Verify S3 bucket policy permissions for CloudTrail log delivery.
Determine that the S3 bucket policy must explicitly permit the CloudTrail service principal (cloudtrail.amazonaws.com) to perform the s3:PutObject action.
Without this permission, S3 will reject write requests from CloudTrail, preventing logs from being delivered.
3
Verify KMS key policy permissions for CloudTrail log encryption.
Determine that the customer managed KMS key policy must explicitly permit the CloudTrail service principal (cloudtrail.amazonaws.com) to perform the kms:GenerateDataKey* and kms:DescribeKey actions.
Because CloudTrail performs client-side encryption of logs before uploading them to S3, it must have permission to generate data keys using the specified customer managed key.

Key Concept

AWS CloudTrail log delivery relies on resource-based policies (S3 bucket policy and KMS key policy) to grant the CloudTrail service principal the necessary permissions to write to S3 and encrypt logs using customer managed KMS keys.
Rate this question

Topics

AWS CloudTrail Configuration and Management

More questions from this topic