Examkin

Question

Difficulty: MediumSecurity Monitoring, Logging, and Compliance Auditing

A SysOps Administrator is configuring a new organizational trail in AWS CloudTrail to deliver log files to a centralized Amazon S3 bucket. The security team has mandated that the log files must be encrypted at rest using an AWS Key Management Service (AWS KMS) customer managed key. Additionally, the administrator must ensure that any post-delivery modification or deletion of the log files can be systematically detected. Which two actions must the SysOps Administrator take to meet these requirements?

  1. Enable log file integrity validation on the CloudTrail trail configuration.Answer
  2. Add a statement to the AWS KMS key policy that allows the CloudTrail service principal to perform the kms:GenerateDataKey* and kms:DescribeKey actions.Answer
  3. C
    Add a statement to the Amazon S3 bucket policy that allows the CloudTrail service principal to perform the kms:GenerateDataKey* and kms:DescribeKey actions.
  4. D
    Enable detailed monitoring for AWS CloudTrail log groups in Amazon CloudWatch Logs.
  5. E
    Configure a bucket lifecycle policy on the S3 bucket to transition older CloudTrail log files to S3 Glacier Flexible Retrieval after 30 days.

Answer

To meet the requirements, the SysOps Administrator must enable log file integrity validation on the CloudTrail trail and add a statement to the AWS KMS key policy allowing the CloudTrail service principal to perform kms:GenerateDataKey* and kms:DescribeKey actions.
To satisfy the requirement of detecting log modifications, log file integrity validation must be enabled. This configuration causes CloudTrail to generate digest files containing cryptographic hashes of the logs. To satisfy the encryption requirement using a customer managed key, the KMS key policy must explicitly permit the CloudTrail service principal to generate data keys. S3 bucket policies cannot delegate KMS key access.

Step-by-Step Solution

1
Enable log file integrity validation on the trail.
CloudTrail begins generating digest files that contain cryptographic hashes of the delivered log files.
This allows the SysOps Administrator to verify that the delivered log files have not been modified or tampered with post-delivery.
2
Identify the customer managed KMS key policy.
The key policy controlling access to the KMS key is opened for editing.
Permissions to use a customer managed key for encryption must be explicitly granted within the key policy.
3
Add a statement to the key policy granting kms:GenerateDataKey* and kms:DescribeKey to the cloudtrail.amazonaws.com service principal.
CloudTrail is granted the necessary cryptographic permissions to encrypt the log files as they are written to the target S3 bucket.
S3 bucket policies cannot delegate KMS key access; permissions must be managed at the key policy level.

Key Concept

Configuring AWS CloudTrail security, including log file integrity validation and custom KMS key permissions for secure S3 log delivery.
Rate this question

Topics

Security Monitoring, Logging, and Compliance Auditing

More questions from this topic