Examkin

Question

Difficulty: MediumAWS CloudTrail Configuration and Management

A SysOps Administrator enabled log file integrity validation on an AWS CloudTrail trail. The trail encrypts its logs at rest using a customer managed AWS KMS key and delivers them to an Amazon S3 bucket. An audit requires the administrator to verify the integrity of the logs using the AWS CLI. However, when running the `aws cloudtrail validate-logs` command, the validation fails. Which of the following configuration issues could cause this validation failure? (Select TWO.)

  1. An S3 Lifecycle rule has transitioned the digest files under the prefix CloudTrail-Digest/ to the Amazon S3 Glacier Flexible Retrieval storage class.Answer
  2. The IAM identity executing the AWS CLI command lacks the kms:Decrypt permission for the customer managed KMS key.Answer
  3. C
    The CloudTrail service-linked role does not have the cloudtrail:ValidateLogs permission.
  4. D
    The S3 bucket policy does not grant the cloudtrail.amazonaws.com service principal the s3:GetObject permission on the S3 bucket objects.

Answer

An S3 Lifecycle rule transitioning the digest files under the CloudTrail-Digest/ prefix to Amazon S3 Glacier Flexible Retrieval, and the IAM identity executing the command lacking the kms:Decrypt permission for the customer managed KMS key.
Log file integrity validation is a client-side function executed by the AWS CLI. The CLI downloads the digest files and log files from the S3 bucket and verifies the hashes. Therefore, the files must be immediately available (not transitioned to Glacier storage classes) and the administrator's IAM identity must have the necessary decryption rights via the KMS key policy.

Step-by-Step Solution

1
Check the location and availability of the digest files in the S3 bucket.
Identify if the digest files are archived in a Glacier storage class, which requires restoration before validation can proceed.
The validate-logs command needs immediate read access to the digest files to perform integrity checks.
2
Verify the permissions of the IAM identity running the command.
Ensure the IAM identity has s3:GetObject and s3:ListBucket permissions on the S3 bucket, as well as kms:Decrypt permission on the KMS key used for encryption.
The validation process runs locally on the administrator's machine and must download and decrypt the log and digest files directly.

Key Concept

CloudTrail log file integrity validation relies on local CLI processing that fetches digest and log files directly from S3, requiring both immediate file availability (not archived in Glacier) and adequate read/decrypt permissions for the administrator's IAM identity.
Rate this question

Topics

AWS CloudTrail Configuration and Management

More questions from this topic