A SysOps Administrator is configuring an AWS Organizations trail in the management account (111111111111) to log API activity across all member accounts in the organization (o-exampleorgid). The logs must be stored in an Amazon S3 bucket named `my-organization-logs-bucket` in a dedicated log archive account (222222222222). The logs must also be encrypted at rest using a customer managed AWS KMS key located in the log archive account.
After creating the trail, the Administrator notices that logs are not being delivered to the S3 bucket, and CloudTrail reports a log delivery failure due to access denied errors.
Which two actions should the SysOps Administrator take to resolve this issue? (Select TWO.)
- Update the S3 bucket policy in the log archive account (222222222222) to allow the `cloudtrail.amazonaws.com` service principal to perform `s3:PutObject` actions on the resource path `arn:aws:s3:::my-organization-logs-bucket/AWSLogs/o-exampleorgid/*`.Answer
- Update the KMS key policy in the log archive account (222222222222) to allow the `cloudtrail.amazonaws.com` service principal to perform `kms:GenerateDataKey*` and `kms:DescribeKey` actions on the KMS key.Answer
- CCreate an IAM role in the management account (111111111111) with write permissions to the log archive account's S3 bucket, and configure the organization trail to assume this role for log delivery.
- DUpdate the S3 bucket policy in the log archive account (222222222222) to grant `s3:PutObject` permissions to the management account's root user principal (`arn:aws:iam::111111111111:root`) for the path `arn:aws:s3:::my-organization-logs-bucket/AWSLogs/111111111111/*`.
- EConfigure an EventBridge rule in the management account (111111111111) that triggers on CloudTrail delivery errors and automatically executes an AWS Systems Manager Automation document to copy log files from the local buffer to the remote S3 bucket.
Answer
Updating the S3 bucket policy in the log archive account to allow the CloudTrail service principal to perform s3:PutObject actions on the path prefixed with the organization ID, and updating the KMS key policy in the log archive account to allow the CloudTrail service principal to perform kms:GenerateDataKey* and kms:DescribeKey actions.
To configure cross-account log delivery for an AWS Organizations trail with KMS encryption, the destination resource policies must be properly updated. First, the S3 bucket policy must grant `s3:PutObject` permission to the `cloudtrail.amazonaws.com` service principal under the organization prefix `AWSLogs/o-exampleorgid/*`. Second, because the bucket uses customer managed KMS encryption, the KMS key policy in the destination account must grant `kms:GenerateDataKey*` and `kms:DescribeKey` to the `cloudtrail.amazonaws.com` service principal to allow CloudTrail to generate encryption keys for the logs.
Step-by-Step Solution
Key Concept
Cross-account log delivery for AWS Organizations trails using S3 bucket policies and KMS key encryption.
Estimated Time:2m 30s