Examkin

Question

Difficulty: EasyTroubleshooting Monitoring, Logging, and Permissions

A SysOps administrator recently configured AWS CloudTrail to deliver event logs to an Amazon S3 bucket. However, when checking the S3 bucket, the administrator discovers that no CloudTrail logs are being delivered. Which of the following root causes could be responsible for this delivery failure? (Select TWO.)

  1. The S3 bucket policy does not grant the CloudTrail service principal permission to perform the PutObject action.Answer
  2. The AWS KMS key policy used to encrypt the S3 bucket or the logs does not grant the CloudTrail service principal permission to use the key.Answer
  3. C
    The CloudWatch Log Group associated with the CloudTrail trail has a retention period configuration of zero days.
  4. D
    CloudWatch detailed monitoring is disabled on the S3 bucket, preventing it from receiving external log streams.
  5. E
    The SysOps administrator did not assign iam:PassRole permissions to the target S3 bucket policy.

Answer

The S3 bucket policy must grant 's3:PutObject' permissions to the CloudTrail service principal, and the AWS KMS key policy must grant permissions to the CloudTrail service principal to generate data keys for encryption.
For CloudTrail to deliver logs successfully, the destination S3 bucket policy must allow the CloudTrail service principal ('cloudtrail.amazonaws.com') to perform the 's3:PutObject' action. Additionally, if KMS encryption is configured, the key policy must grant 'cloudtrail.amazonaws.com' permissions to generate the data keys needed to encrypt the log objects before writing them.

Step-by-Step Solution

1
Check the S3 bucket policy.
Identify if the 'cloudtrail.amazonaws.com' service principal has been granted 's3:PutObject' access to the bucket.
CloudTrail requires explicit permission to write logs to the target S3 bucket.
2
Check the KMS key policy if KMS encryption is enabled.
Verify that 'cloudtrail.amazonaws.com' is allowed to perform 'kms:GenerateDataKey*' on the KMS key.
If the trail or S3 bucket is encrypted using a KMS key, CloudTrail needs permissions to generate encryption keys to write the encrypted files.

Key Concept

AWS CloudTrail requires permissions to write logs to an S3 bucket, which involves bucket policies and, if applicable, KMS key policies.
Estimated Time:1m 30s
Rate this question

Topics

Troubleshooting Monitoring, Logging, and Permissions

More questions from this topic