A SysOps Administrator is setting up an organization trail in AWS CloudTrail to log all AP… — AWS Certified SysOps Administrator - Associate

A SysOps Administrator is setting up an organization trail in AWS CloudTrail to log all API activity across all accounts in an AWS Organization. The trail is created in the management account (account ID $111122223333$ ) and is configured to deliver logs to an Amazon S3 bucket named `org-audit-logs` located in a dedicated security tooling account (account ID $444455556666$ ). The administrator also configures the trail to encrypt all log files using a customer managed KMS key, which is also located in the security tooling account ( $444455556666$ ). However, after configuring the trail, the administrator detects that log files are not appearing in the S3 bucket, and CloudTrail reports delivery errors. Which of the following configuration steps must be performed in the security tooling account ( $444455556666$ ) to resolve this issue and enable successful log delivery? (Select TWO.)

Configure the S3 bucket policy on `org-audit-logs` to grant the `cloudtrail.amazonaws.com` service principal the `s3:GetBucketAcl` permission on the bucket resource and the `s3:PutObject` permission on the prefix `arn:aws:s3:::org-audit-logs/AWSLogs/o-exampleorgid/*`.Answer
Configure the KMS key policy in the security tooling account to allow the `cloudtrail.amazonaws.com` service principal to perform `kms:GenerateDataKey*` and `kms:Decrypt` actions, with a condition restricting `aws:SourceArn` to the trail ARN in the management account.Answer
C
Configure the S3 bucket policy on `org-audit-logs` to grant the management account's IAM root principal (`arn:aws:iam::111122223333:root`) the `s3:PutObject` permission on the prefix `arn:aws:s3:::org-audit-logs/AWSLogs/111122223333/*`.
D
Attach an IAM policy to the CloudTrail service-linked role in the management account ( $111122223333$ ) that allows `kms:GenerateDataKey*` and `kms:Decrypt` permissions on the customer managed KMS key in the security tooling account.
E
Configure the S3 bucket policy on `org-audit-logs` to grant the `cloudtrail.amazonaws.com` service principal `s3:PutObject` permissions restricted only to the path `arn:aws:s3:::org-audit-logs/AWSLogs/111122223333/*`.

Answer

Configure the S3 bucket policy on the destination bucket to grant `cloudtrail.amazonaws.com` service principal permissions to `s3:GetBucketAcl` and `s3:PutObject` on the organization path prefix, and configure the KMS key policy in the security tooling account to grant the same principal `kms:GenerateDataKey*` and `kms:Decrypt` permissions constrained by the trail's source ARN.

To enable cross-account CloudTrail log delivery for an organization trail, the S3 bucket policy in the destination account must explicitly allow the CloudTrail service principal (`cloudtrail.amazonaws.com`) to write log files using the `s3:PutObject` action. Because it is an organization trail, the prefix structure must target the organization ID (`o-exampleorgid`) rather than a single account ID. Additionally, the bucket policy must grant `s3:GetBucketAcl` to allow CloudTrail to verify ownership of the bucket. Since the logs are encrypted with a customer managed KMS key in the destination account, the KMS key policy must also explicitly allow the `cloudtrail.amazonaws.com` service principal to perform `kms:GenerateDataKey*` and `kms:Decrypt` actions, and this should be secured using the `aws:SourceArn` condition pointing to the trail in the management account.

Step-by-Step Solution

Verify the S3 bucket policy permissions for CloudTrail log delivery.

Ensure the S3 bucket policy allows `cloudtrail.amazonaws.com` to call `s3:GetBucketAcl` on the bucket and `s3:PutObject` on the path prefix `AWSLogs/o-organizationId/*`.

CloudTrail requires ownership checks and permission to write logs across all member accounts under the organization prefix.

Configure the customer managed KMS key policy for encryption.

Ensure the KMS key policy allows `cloudtrail.amazonaws.com` to perform `kms:GenerateDataKey*` and `kms:Decrypt`.

Because the customer managed key is in a different account, the key policy must explicitly authorize the CloudTrail service principal to generate data keys and decrypt logs.

Apply condition keys to secure the KMS key policy.

Restrict the KMS key policy statement using `aws:SourceArn` pointing to the trail in the management account.

Secures the KMS key so that only the specified organizational trail can request key operations.

Key Concept

Cross-account AWS CloudTrail organization trail delivery to an S3 bucket encrypted with a customer managed KMS key requires configuring both the S3 bucket policy and the KMS key policy to trust the CloudTrail service principal (`cloudtrail.amazonaws.com`) with the appropriate action permissions and path/ARN constraints.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic