Examkin

Question

Difficulty: MediumSecurity Monitoring, Logging, and Compliance Auditing

A SysOps Administrator is configuring AWS CloudTrail to deliver logs from a production account to a centralized Amazon S3 bucket located in a dedicated security account. The trail is created in the production AWS account, but logs are not appearing in the destination S3 bucket. What must the administrator do to resolve this issue?

  1. A
    Associate the destination S3 bucket with the VPC route table using an S3 Gateway Endpoint.
  2. Update the destination S3 bucket policy in the security account to grant write permissions (s3:PutObject) to the AWS CloudTrail service principal.Answer
  3. C
    Attach an IAM policy to the CloudTrail service role in the production account that includes the iam:PassRole permission.
  4. D
    Enable detailed monitoring within AWS CloudTrail settings to authorize log transmission across account boundaries.

Answer

Update the destination S3 bucket policy in the security account to grant write permissions (s3:PutObject) to the AWS CloudTrail service principal.
For CloudTrail to deliver logs to an S3 bucket in a different AWS account, the S3 bucket policy in the destination account must explicitly grant permissions to the CloudTrail service principal ('cloudtrail.amazonaws.com'). The minimum required permissions are 's3:PutObject' to write the logs and 's3:GetBucketAcl' to verify ownership of the bucket.

Step-by-Step Solution

1
Analyze cross-account log delivery mechanics.
Identify that the resource (S3 bucket) is owned by the security account, whereas the service generator (CloudTrail) resides in the production account.
Cross-account resource access is denied by default in AWS unless explicitly permitted by a resource-based policy.
2
Configure the destination resource policy.
Add an S3 bucket policy that permits 's3:PutObject' (and 's3:GetBucketAcl') with the principal set to 'cloudtrail.amazonaws.com'.
This grants the CloudTrail service running in the production account permission to write objects directly into the destination bucket.

Key Concept

Cross-account log delivery to an S3 bucket requires resource-based access permissions (S3 bucket policy) to authorize the AWS service principal.
Rate this question

Topics

Security Monitoring, Logging, and Compliance Auditing

More questions from this topic