Examkin

Question

Difficulty: HardAWS CloudTrail Configuration and Management

A SysOps Administrator is configuring a new multi-region trail in AWS CloudTrail for Account A (111111111111111111111111). The trail is configured to deliver logs to a centralized Amazon S3 bucket located in Account B (222222222222222222222222). The bucket is configured to encrypt all new objects using a Customer Managed Key (CMK) in AWS KMS located in Account B. The S3 bucket policy in Account B has been updated to allow log delivery from Account A, but CloudTrail displays a log delivery error and no log files are generated. Which configuration change will resolve this log delivery failure?

  1. Add a statement to the KMS key policy in Account B that grants the CloudTrail service principal (cloudtrail.amazonaws.com) the permissions to perform kms:GenerateDataKey* and kms:DescribeKey, using a condition to verify the source trail ARN:

    {
    "Sid": "Allow CloudTrail to encrypt logs",
    "Effect": "Allow",
    "Principal": {
    "Service": "cloudtrail.amazonaws.com"
    },
    "Action": [
    "kms:GenerateDataKey*",
    "kms:DescribeKey"
    ],
    "Resource": "*",
    "Condition": {
    "StringLike": {
    "kms:EncryptionContext:aws:cloudtrail:arn": "arn:aws:cloudtrail:*:111111111111:trail/*"
    }
    }
    }
    Answer
  2. B
    Add a statement to the S3 bucket policy in Account B that grants the CloudTrail service principal the permissions to perform kms:GenerateDataKey* and kms:DescribeKey on the encryption key:

    {
    "Sid": "Allow CloudTrail KMS encryption",
    "Effect": "Allow",
    "Principal": {
    "Service": "cloudtrail.amazonaws.com"
    },
    "Action": [
    "kms:GenerateDataKey*",
    "kms:DescribeKey"
    ],
    "Resource": "arn:aws:kms:us-east-1:222222222222:key/my-kms-key"
    }
  3. C
    Attach an IAM policy to the IAM execution role used by CloudTrail in Account A to allow key usage across accounts:

    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Sid": "Allow KMS usage for CloudTrail",
    "Effect": "Allow",
    "Action": [
    "kms:GenerateDataKey*",
    "kms:DescribeKey"
    ],
    "Resource": "arn:aws:kms:us-east-1:222222222222:key/my-kms-key"
    }
    ]
    }
  4. D
    Attach an IAM policy to the CloudTrail administrator in Account A to allow passing the delivery role to CloudTrail across accounts:

    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Sid": "Allow PassRole to CloudTrail",
    "Effect": "Allow",
    "Action": "iam:PassRole",
    "Resource": "arn:aws:iam::111111111111:role/CloudTrailDeliveryRole",
    "Condition": {
    "StringEquals": {
    "iam:PassedToService": "cloudtrail.amazonaws.com"
    }
    }
    }
    ]
    }

Answer

Add a statement to the KMS key policy in Account B that grants the CloudTrail service principal (cloudtrail.amazonaws.com) the permissions to perform kms:GenerateDataKey* and kms:DescribeKey, using a condition to verify the source trail ARN.
When a CloudTrail trail delivers logs to an Amazon S3 bucket encrypted with a Customer Managed Key (CMK), the CloudTrail service principal (cloudtrail.amazonaws.com) must have permissions to use the key. Because the key is in Account B and the trail is in Account A, the KMS key policy in Account B must explicitly permit the service principal to perform kms:GenerateDataKey* and kms:DescribeKey. Using the kms:EncryptionContext condition ensures that only the trail from Account A can use the key for log encryption.

Step-by-Step Solution

1
Identify the principal delivering the logs.
The AWS CloudTrail service principal (cloudtrail.amazonaws.com) is the caller that attempts to write logs and use the KMS key.
CloudTrail performs log writing and encryption directly under its own service identity, not a user-defined role.
2
Identify the resource policy where the permissions must be defined.
The target KMS key is in Account B, meaning only the KMS key policy in Account B can authorize cross-account access for the service principal.
KMS key policies must explicitly trust external principals and service principals for cross-account access.
3
Define the correct KMS actions and scoping conditions.
The actions kms:GenerateDataKey* and kms:DescribeKey are required, and the kms:EncryptionContext condition scopes the access to only the specific source trail in Account A.
This configuration enables CloudTrail to encrypt the files before putting them in the S3 bucket while ensuring other accounts cannot abuse the key.

Key Concept

Cross-account AWS CloudTrail log delivery with KMS encryption requires explicit KMS key policy permissions for the CloudTrail service principal.
Rate this question

Topics

AWS CloudTrail Configuration and Management

More questions from this topic