Examkin

Question

Difficulty: Very hardAWS CloudTrail Configuration and Management

A SysOps Administrator is setting up an AWS CloudTrail organization trail in the management account (account ID 111122223333) to log all API activity across all accounts in an AWS Organization (org ID o-exampleorg12). The administrator creates a centralized S3 bucket named org-audit-logs-bucket in the management account.

The S3 bucket policy is configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AWSCloudTrailAclCheck",
"Effect": "Allow",
"Principal": {
"Service": "cloudtrail.amazonaws.com"
},
"Action": "s3:GetBucketAcl",
"Resource": "arn:aws:s3:::org-audit-logs-bucket"
},
{
"Sid": "AWSCloudTrailWrite",
"Effect": "Allow",
"Principal": {
"Service": "cloudtrail.amazonaws.com"
},
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::org-audit-logs-bucket/AWSLogs/111122223333/*",
"Condition": {
"StringEquals": {
"s3:x-amz-acl": "bucket-owner-full-control"
}
}
}
]
}

After creating the organization trail, the administrator notices that logs from the management account are successfully delivered, but no logs are appearing for any of the member accounts in the organization. How should the SysOps Administrator modify the configuration to ensure logs from all member accounts are successfully delivered?

  1. A
    Modify the AWSCloudTrailWrite statement condition to use aws:PrincipalOrgID matching o-exampleorg12 while retaining only the management account log path in the Resource element.
  2. B
    Modify the key policy of the AWS managed key aws/s3 to allow kms:GenerateDataKey permissions for the cloudtrail.amazonaws.com service principal.
  3. Modify the S3 bucket policy's AWSCloudTrailWrite statement to include arn:aws:s3:::org-audit-logs-bucket/AWSLogs/o-exampleorg12/* in the Resource element.Answer
  4. D
    Create a new IAM role in each member account with trust relationships configured for CloudTrail, and delegate s3:PutObject permission to those roles to write directly to the S3 bucket.

Answer

Modify the S3 bucket policy's AWSCloudTrailWrite statement to include the organization ID log prefix (arn:aws:s3:::org-audit-logs-bucket/AWSLogs/o-exampleorg12/*) in the Resource element.
For an AWS Organizations trail, AWS CloudTrail delivers log files for member accounts to a path prefixed with the organization ID (e.g., `AWSLogs/o-exampleorg12/`) rather than the individual management account ID. The S3 bucket policy must explicitly permit the `s3:PutObject` action for this path. Updating the `Resource` list in the `AWSCloudTrailWrite` statement to include `arn:aws:s3:::org-audit-logs-bucket/AWSLogs/o-exampleorg12/*` allows CloudTrail to write the logs for all member accounts.

Step-by-Step Solution

1
Analyze how CloudTrail writes logs for Organization trails.
Identify that CloudTrail delivers member account logs under the path prefix matching the Organization ID (o-orgId), whereas management account logs are delivered under the management account ID prefix.
To explain why only management account logs are successfully delivering while member logs are failing.
2
Examine the S3 bucket policy Resource element.
Locate the restriction where only the resource path 'arn:aws:s3:::org-audit-logs-bucket/AWSLogs/111122223333/*' is permitted for s3:PutObject.
To pinpoint the configuration mismatch causing the delivery failure for member accounts.
3
Update the Resource list in the S3 bucket policy.
Add 'arn:aws:s3:::org-audit-logs-bucket/AWSLogs/o-exampleorg12/*' to the Resource list of the AWSCloudTrailWrite statement.
To authorize the CloudTrail service principal to write to the correct S3 path prefix used for member accounts.

Key Concept

CloudTrail Organization Trails S3 Bucket Policy Requirements
Rate this question

Topics

AWS CloudTrail Configuration and Management

More questions from this topic