Examkin

Question

Difficulty: HardSecurity Monitoring, Logging, and Compliance Auditing

A SysOps Administrator is configuring an AWS Organization-level trail to collect management events from all member accounts. The CloudTrail logs are consolidated into an Amazon S3 bucket located in a dedicated Security Operations account. To meet compliance requirements, the trail must be encrypted using a customer managed AWS KMS key located in the same Security Operations account. After configuring the organizational trail and specifying the KMS key, the administrator notices that no logs are being delivered to the S3 bucket, and CloudTrail reports access denied errors. The S3 bucket policy is already correctly configured to allow the cloudtrail.amazonaws.com service principal to write logs. Which configuration change must the administrator make to resolve this delivery failure?

  1. Update the KMS key policy in the Security Operations account to grant the cloudtrail.amazonaws.com service principal permission to perform the kms:GenerateDataKey* and kms:DescribeKey actions, with a condition restricting the source ARN to the organizational trail.Answer
  2. B
    Add a statement to the S3 bucket policy in the Security Operations account that grants the kms:GenerateDataKey* and kms:DescribeKey actions to the cloudtrail.amazonaws.com service principal.
  3. C
    Modify the IAM role associated with the organizational trail in each member account to include permissions for the kms:Decrypt and kms:GenerateDataKey* actions, relying on the default KMS key policy that delegates key access to root IAM policies.
  4. D
    Update the IAM policies in the member accounts to grant the iam:PassRole permission to the CloudTrail service, allowing it to assume the execution role required to access the customer managed KMS key.

Answer

Update the KMS key policy in the Security Operations account to grant the cloudtrail.amazonaws.com service principal permission to perform the kms:GenerateDataKey* and kms:DescribeKey actions, with a condition restricting the source ARN to the organizational trail.
The CloudTrail service principal requires permissions on the customer managed KMS key to generate data keys and encrypt the log files before they are written to the S3 bucket. Because the KMS key is customer managed, these permissions must be explicitly granted in the key policy. The correct approach is to allow the cloudtrail.amazonaws.com principal to perform kms:GenerateDataKey* and kms:DescribeKey operations on the key. Additionally, adding a condition that restricts the aws:SourceArn to the specific organization trail prevents unauthorized accounts or services from using the key.

Step-by-Step Solution

1
Analyze the log delivery flow and identify where the failure occurs.
The S3 bucket policy is verified to allow CloudTrail log writes, but CloudTrail reports Access Denied because it lacks authorization to use the KMS key for server-side encryption.
When a customer managed KMS key is selected for CloudTrail encryption, CloudTrail must have permissions on the KMS key to generate data keys for encryption.
2
Determine the proper location for granting KMS encryption permissions.
Identify that S3 bucket policies cannot control KMS keys, and cross-account IAM policies are blocked unless delegated by the key policy itself.
KMS key policies are the primary authorizers for KMS keys. Service principal permissions must be defined within the key policy.
3
Formulate the correct KMS key policy statement.
Configure permissions for the cloudtrail.amazonaws.com service principal to execute kms:GenerateDataKey* and kms:DescribeKey, restricted by the organizational trail's ARN to enforce the principle of least privilege.
This grants CloudTrail the minimum permissions required to perform envelope encryption on log files delivered to the target S3 bucket.

Key Concept

AWS KMS key policies for cross-account CloudTrail log encryption
Rate this question

Topics

Security Monitoring, Logging, and Compliance Auditing

More questions from this topic