Examkin

Question

Difficulty: MediumTroubleshooting Monitoring, Logging, and Permissions

A SysOps administrator is troubleshooting log delivery for a multi-account setup. AWS CloudTrail in Account B is configured to send logs to a central Amazon S3 bucket in Account A. The S3 bucket is encrypted using an AWS Key Management Service (AWS KMS) customer managed key in Account A. Currently, no logs from Account B are being delivered to the S3 bucket.

Which of the following configuration changes are required to resolve this issue? (Select TWO.)

  1. Update the Amazon S3 bucket policy in Account A to grant the CloudTrail service principal s3:PutObject permissions for the folder path corresponding to Account B.Answer
  2. Update the KMS key policy in Account A to allow the CloudTrail service principal to perform the kms:GenerateDataKey* action.Answer
  3. C
    Modify the IAM role in Account B used by CloudTrail to include kms:GenerateDataKey permissions for Account A's KMS key.
  4. D
    Enable detailed monitoring on the CloudTrail configuration in Account B to reduce the delivery interval to 1 minute.
  5. E
    Create an Amazon EventBridge rule in Account B to trigger a Systems Manager Automation document that replicates logs to Account A.

Answer

Updating the Amazon S3 bucket policy in Account A to grant s3:PutObject permissions to the CloudTrail service principal, and updating the AWS KMS key policy in Account A to allow the CloudTrail service principal to perform the kms:GenerateDataKey* action.
To successfully deliver CloudTrail logs across accounts to an encrypted S3 bucket, two distinct permissions must be configured in the destination account (Account A). First, the Amazon S3 bucket policy must allow the CloudTrail service principal (cloudtrail.amazonaws.com) to perform the s3:PutObject action for the folders containing Account B's logs. Second, since a customer managed KMS key is used for encryption, the KMS key policy in Account A must allow the CloudTrail service principal to execute the kms:GenerateDataKey* action to encrypt the objects.

Step-by-Step Solution

1
Identify the service principal responsible for log delivery.
CloudTrail uses the service principal cloudtrail.amazonaws.com to deliver logs directly.
Since the logs are written by the AWS service itself rather than an IAM role, permissions must be granted directly to the CloudTrail service principal.
2
Grant S3 write permissions to the destination bucket in Account A.
The bucket policy in Account A is updated to allow s3:PutObject for the CloudTrail service principal, referencing Account B's path.
By default, cross-account write access is denied. The bucket policy must explicitly permit the CloudTrail service principal to write to the bucket.
3
Configure KMS key usage permissions in Account A.
The customer managed KMS key policy in Account A is updated to grant kms:GenerateDataKey* and kms:Decrypt permissions to the CloudTrail service principal.
When a destination bucket uses KMS customer managed key encryption, the CloudTrail service must have key permissions to generate data keys and encrypt the log files.

Key Concept

Cross-account CloudTrail log delivery requires configuring both the destination S3 bucket policy and the associated KMS key policy to permit the CloudTrail service principal (cloudtrail.amazonaws.com) to write objects and generate data keys.

Alternative Method

If SSE-KMS encryption is not strictly required to be managed via a customer managed key, changing the S3 bucket encryption to use the default Amazon S3 managed key (SSE-S3) would remove the need to configure KMS key policies, though the S3 bucket policy update would still be required.
Estimated Time:2m 0s
Rate this question

Topics

Troubleshooting Monitoring, Logging, and Permissions

More questions from this topic