Examkin

Question

Difficulty: HardAWS CloudTrail Configuration and Management

A SysOps Administrator is setting up an organization trail in AWS CloudTrail to aggregate API activity logs from all member accounts into a centralized Amazon S3 bucket named company-audit-logs in the organization's management account (account ID 111122223333). The administrator creates the S3 bucket and configures the following bucket policy statement to authorize log delivery:

{
"Sid": "AWSCloudTrailWrite",
"Effect": "Allow",
"Principal": {"Service": "cloudtrail.amazonaws.com"},
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::company-audit-logs/AWSLogs/111122223333/*",
"Condition": {
"StringEquals": {
"s3:x-amz-acl": "bucket-owner-full-control"
}
}
}

After enabling the organization trail, the administrator discovers that log files are successfully delivered for the management account, but log delivery fails for all member accounts with an access denied error. What action should the administrator take to resolve this issue?

  1. Modify the S3 bucket policy's Resource parameter to target arn:aws:s3:::company-audit-logs/AWSLogs/o-organizationid/*, replacing o-organizationid with the ID of the organization.Answer
  2. B
    Add a condition block to the existing S3 bucket policy statement that checks for "StringEquals": {"aws:PrincipalOrgID": "o-organizationid"} while maintaining the original Resource path.
  3. C
    Create a cross-account IAM role in each member account that allows s3:PutObject permissions to the bucket, and configure the organization trail to assume this role for log delivery.
  4. D
    Create separate statements in the S3 bucket policy for each member account, specifying arn:aws:s3:::company-audit-logs/AWSLogs/member-account-id/* as the Resource for each member account.

Answer

Modify the S3 bucket policy's Resource parameter to target arn:aws:s3:::company-audit-logs/AWSLogs/o-organizationid/*, replacing o-organizationid with the ID of the organization.
Updating the S3 bucket policy's Resource path to include the organization ID format matches the prefix CloudTrail uses for organization trails. This ensures that CloudTrail can successfully write logs for all accounts within the organization structure.

Step-by-Step Solution

1
Determine the S3 bucket path structure used by AWS CloudTrail for organization trails.
CloudTrail writes organization trail logs using the path structure AWSLogs/o-orgid/account-id/ instead of AWSLogs/account-id/.
This path separation prevents conflict and organizes logs by organization ID before member account ID.
2
Evaluate the current S3 bucket policy's Resource element against the target delivery path.
The current Resource element allows writes only to AWSLogs/111122223333/*, which fails to match the required path containing the organization ID prefix for member accounts.
S3 evaluates policies strictly; if the write request's path prefix does not match the allowed Resource ARN, the request is denied.
3
Update the Resource ARN in the S3 bucket policy to allow writing to the organization-specific prefix path.
The Resource parameter is updated to include the wildcard organization path: arn:aws:s3:::company-audit-logs/AWSLogs/o-organizationid/*.
This ensures that CloudTrail has permissions to write logs for all accounts under the organization, resolving the delivery failure.

Key Concept

AWS CloudTrail organization trails store logs in S3 using an organization ID prefix (AWSLogs/o-orgid/), requiring the S3 bucket policy to grant write permissions explicitly to that path structure.
Rate this question

Topics

AWS CloudTrail Configuration and Management

More questions from this topic