An organization trail is deployed in a management account to aggregate logs from all member accounts into a central Amazon S3 bucket within a dedicated audit account. To meet security standards, log encryption is enabled using a customer managed AWS KMS key. The deployment succeeds, but the SysOps administrator notices that no CloudTrail logs are appearing in the destination S3 bucket.
Which configurations must be verified and corrected to enable successful log delivery? (Select TWO.)
- The S3 bucket policy in the audit account must include a statement permitting the CloudTrail service principal:
{
"Sid": "AWSCloudTrailWrite",
"Effect": "Allow",
"Principal": {"Service": "cloudtrail.amazonaws.com"},
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::audit-logs-bucket/AWSLogs/o-orgid/*",
"Condition": {
"StringEquals": {
"s3:x-amz-acl": "bucket-owner-full-control"
}
}
}
Answer - The KMS key policy must include a statement allowing the CloudTrail service principal to generate data keys:
{
"Sid": "Allow CloudTrail to encrypt logs",
"Effect": "Allow",
"Principal": {"Service": "cloudtrail.amazonaws.com"},
"Action": [
"kms:GenerateDataKey*",
"kms:DescribeKey"
],
"Resource": "*"
}
Answer - CThe S3 bucket policy in the audit account must include a statement allowing the management account's root principal:
{
"Sid": "AllowManagementAccountWrite",
"Effect": "Allow",
"Principal": {"AWS": "arn:aws:iam::111122223333:root"},
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::audit-logs-bucket/*"
} - DThe IAM policy attached to the user or role executing the trail creation must include the following permissions:
{
"Sid": "AllowCloudTrailKMSEncrypt",
"Effect": "Allow",
"Action": [
"kms:Encrypt",
"kms:GenerateDataKey"
],
"Resource": "arn:aws:kms:us-east-1:111122223333:key/key-id"
} - EThe member accounts must assign an IAM policy to the CloudTrail service principal with iam:PassRole permissions to allow the management account to assume a logging role:
{
"Sid": "AllowPassRoleForCloudTrail",
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": "arn:aws:iam::*:role/CloudTrailLoggingRole"
}
Answer
To allow CloudTrail to deliver logs, configure the destination S3 bucket policy to permit the cloudtrail.amazonaws.com service principal to write to the organization-specific path, and modify the customer managed KMS key policy to permit the same service principal to execute kms:GenerateDataKey* and kms:DescribeKey.
The correct configurations involve setting resource-based access permissions. First, the S3 bucket policy must allow the CloudTrail service principal to perform `s3:PutObject` on the organization prefix. Second, the KMS key policy must authorize the CloudTrail service principal to perform `kms:GenerateDataKey*` and `kms:DescribeKey` so it can encrypt logs at the destination.
Step-by-Step Solution
Key Concept
CloudTrail multi-account log delivery requires resource-based policy configurations for S3 and KMS to authorize the CloudTrail service principal.