Examkin

Question

Difficulty: MediumAWS CloudTrail Configuration and Management

A SysOps Administrator is configuring a new organizational trail in AWS CloudTrail. The trail is configured to send logs to a central Amazon S3 bucket located in a dedicated logging account. The S3 bucket is encrypted using a customer managed key (CMK) in AWS Key Management Service (AWS KMS). After enabling the trail, the administrator notices that API activity is not being recorded in the S3 bucket, and CloudTrail reports log delivery errors. Which actions must the SysOps Administrator take to resolve this log delivery issue? (Select TWO.)

  1. Update the S3 bucket policy in the logging account to grant s3:PutObject permissions to the CloudTrail service principal (cloudtrail.amazonaws.com).Answer
  2. Update the KMS key policy to grant the CloudTrail service principal (cloudtrail.amazonaws.com) permissions to call kms:GenerateDataKey* and kms:DescribeKey on the CMK.Answer
  3. C
    Attach an IAM policy to the CloudTrail service-linked role in the member accounts allowing s3:PutObject and kms:GenerateDataKey*.
  4. D
    Create an IAM policy for the SysOps Administrator role that allows kms:GenerateDataKey* and kms:Decrypt on the CMK.
  5. E
    Configure an Amazon EventBridge rule that triggers an AWS Systems Manager Automation runbook to replicate logs from the source accounts to the central S3 bucket.

Answer

Update the S3 bucket policy in the logging account to grant s3:PutObject permissions to the CloudTrail service principal, and update the KMS key policy to grant the CloudTrail service principal permissions to call kms:GenerateDataKey* and kms:DescribeKey on the CMK.
For CloudTrail to deliver logs successfully to a cross-account S3 bucket encrypted with a customer managed key, permissions must be granted to the CloudTrail service principal (cloudtrail.amazonaws.com) on both resource policies. The S3 bucket policy must allow the s3:PutObject action, and the KMS key policy must allow the kms:GenerateDataKey* and kms:DescribeKey actions so CloudTrail can encrypt the objects as they are delivered.

Step-by-Step Solution

1
Inspect the S3 bucket policy of the destination bucket in the logging account.
Ensure that the policy permits 'cloudtrail.amazonaws.com' to perform 's3:PutObject' for the correct resource path.
CloudTrail requires explicit bucket policy permissions to deliver logs across accounts to a central S3 bucket.
2
Inspect the KMS key policy for the customer managed key used to encrypt the S3 bucket.
Modify the key policy to allow the CloudTrail service principal ('cloudtrail.amazonaws.com') to call 'kms:GenerateDataKey*' and 'kms:DescribeKey'.
Since the bucket is encrypted with a customer managed key, CloudTrail needs permissions to generate the encryption keys needed to write the encrypted logs.

Key Concept

AWS CloudTrail requires permissions to write to destination S3 buckets and use associated KMS keys via resource-based policies (S3 bucket policy and KMS key policy) targeting its service principal.
Rate this question

Topics

AWS CloudTrail Configuration and Management

More questions from this topic