Question

Difficulty: HardAWS CloudTrail Configuration and Management

An organization trail is deployed in a management account to aggregate logs from all member accounts into a central Amazon S3 bucket within a dedicated audit account. To meet security standards, log encryption is enabled using a customer managed AWS KMS key. The deployment succeeds, but the SysOps administrator notices that no CloudTrail logs are appearing in the destination S3 bucket.

Which configurations must be verified and corrected to enable successful log delivery? (Select TWO.)

  1. The S3 bucket policy in the audit account must include a statement permitting the CloudTrail service principal:

    {
    "Sid": "AWSCloudTrailWrite",
    "Effect": "Allow",
    "Principal": {"Service": "cloudtrail.amazonaws.com"},
    "Action": "s3:PutObject",
    "Resource": "arn:aws:s3:::audit-logs-bucket/AWSLogs/o-orgid/*",
    "Condition": {
    "StringEquals": {
    "s3:x-amz-acl": "bucket-owner-full-control"
    }
    }
    }
    Answer
  2. The KMS key policy must include a statement allowing the CloudTrail service principal to generate data keys:

    {
    "Sid": "Allow CloudTrail to encrypt logs",
    "Effect": "Allow",
    "Principal": {"Service": "cloudtrail.amazonaws.com"},
    "Action": [
    "kms:GenerateDataKey*",
    "kms:DescribeKey"
    ],
    "Resource": "*"
    }
    Answer
  3. C
    The S3 bucket policy in the audit account must include a statement allowing the management account's root principal:

    {
    "Sid": "AllowManagementAccountWrite",
    "Effect": "Allow",
    "Principal": {"AWS": "arn:aws:iam::111122223333:root"},
    "Action": "s3:PutObject",
    "Resource": "arn:aws:s3:::audit-logs-bucket/*"
    }
  4. D
    The IAM policy attached to the user or role executing the trail creation must include the following permissions:

    {
    "Sid": "AllowCloudTrailKMSEncrypt",
    "Effect": "Allow",
    "Action": [
    "kms:Encrypt",
    "kms:GenerateDataKey"
    ],
    "Resource": "arn:aws:kms:us-east-1:111122223333:key/key-id"
    }
  5. E
    The member accounts must assign an IAM policy to the CloudTrail service principal with iam:PassRole permissions to allow the management account to assume a logging role:

    {
    "Sid": "AllowPassRoleForCloudTrail",
    "Effect": "Allow",
    "Action": "iam:PassRole",
    "Resource": "arn:aws:iam::*:role/CloudTrailLoggingRole"
    }

Answer

To allow CloudTrail to deliver logs, configure the destination S3 bucket policy to permit the cloudtrail.amazonaws.com service principal to write to the organization-specific path, and modify the customer managed KMS key policy to permit the same service principal to execute kms:GenerateDataKey* and kms:DescribeKey.
The correct configurations involve setting resource-based access permissions. First, the S3 bucket policy must allow the CloudTrail service principal to perform `s3:PutObject` on the organization prefix. Second, the KMS key policy must authorize the CloudTrail service principal to perform `kms:GenerateDataKey*` and `kms:DescribeKey` so it can encrypt logs at the destination.

Step-by-Step Solution

1
Inspect the destination S3 bucket policy in the dedicated audit account.
Ensure a policy statement exists that allows cloudtrail.amazonaws.com to execute s3:PutObject for the resource path prefix AWSLogs/o-organizationid/.
For an organization trail, logs are organized by the organization ID, and CloudTrail requires write permissions to this specific path.
2
Ensure the S3 bucket policy statement enforces the bucket-owner-full-control ACL constraint.
Add a condition statement evaluating s3:x-amz-acl to bucket-owner-full-control.
CloudTrail requires this access control list to ensure the destination bucket owner has full control over the delivered logs.
3
Examine the KMS key policy for the customer managed key used by the trail.
Grant the cloudtrail.amazonaws.com service principal permissions for kms:GenerateDataKey* and kms:DescribeKey.
Because CloudTrail writes and encrypts logs asynchronously, the service principal itself must have permissions to generate data keys using the customer managed key.

Key Concept

CloudTrail multi-account log delivery requires resource-based policy configurations for S3 and KMS to authorize the CloudTrail service principal.
Rate this question