Examkin

Question

Difficulty: HardVPC Flow Logs and Network Monitoring

A SysOps Administrator is configuring VPC Flow Logs to deliver network traffic logs to an Amazon S3 bucket. The target S3 bucket is encrypted using SSE-KMS with a customer managed KMS key. After creating the flow log, the administrator notes that the log status is 'Active', but no log files are being delivered to the bucket. Which action should the administrator take to resolve this log delivery issue?

  1. Update the customer managed KMS key policy to grant the 'delivery.logs.amazonaws.com' service principal permissions for the 'kms:GenerateDataKey*' action.Answer
  2. B
    Create an IAM service role with the 's3:PutObject' permission, configure the role's trust policy to trust the 'vpc-flow-logs.amazonaws.com' service, and assign this role when creating the flow log.
  3. C
    Modify the S3 bucket policy to grant the 'vpc-flow-logs.amazonaws.com' service principal write permissions, and disable KMS encryption on the bucket to bypass key policy checks.
  4. D
    Configure the flow logs to write to an intermediate Amazon CloudWatch Logs group with a 'Never Expire' retention policy, then configure an export task to copy the logs to the S3 bucket.

Answer

Update the customer managed KMS key policy to grant the 'delivery.logs.amazonaws.com' service principal permissions for the 'kms:GenerateDataKey*' action.
For S3 delivery of VPC Flow Logs where the bucket is encrypted with SSE-KMS, the Log Delivery service principal ('delivery.logs.amazonaws.com') requires 'kms:GenerateDataKey*' permissions on the KMS key. This allows the delivery service to generate a data key to encrypt the log objects before writing them to S3.

Step-by-Step Solution

1
Identify the delivery destination type and encryption method used for the VPC Flow Logs.
The destination is an S3 bucket encrypted with SSE-KMS using a customer managed key.
This determines which AWS service permissions and policies govern the log delivery path.
2
Determine the service principal responsible for log delivery to S3.
The service principal is 'delivery.logs.amazonaws.com'.
VPC Flow Logs delivered to S3 use the native Log Delivery service instead of the flow logs service principal or a custom IAM role.
3
Check KMS key policy permissions for the service principal.
The policy must grant 'kms:GenerateDataKey*' permissions.
The Log Delivery service needs to generate a data key to encrypt the log objects before writing them to the S3 bucket.
4
Apply the policy update to the customer managed key to allow successful log delivery.
Flow logs are successfully written and encrypted in the S3 bucket.
Updating the key policy resolves the access denied error and allows the delivery service to write objects.

Key Concept

VPC Flow Logs Delivery Permissions to SSE-KMS Encrypted S3 Buckets
Rate this question

Topics

VPC Flow Logs and Network Monitoring

More questions from this topic