Examkin

Question

Difficulty: MediumVPC Flow Logs and Network Monitoring

A SysOps Administrator is configuring VPC Flow Logs to capture traffic for a production VPC and deliver the logs to an Amazon S3 bucket. The S3 bucket is encrypted using an AWS Key Management Service (AWS KMS) customer managed key. After creating the flow log, the administrator notes that no log files are being written to the S3 bucket, and the flow log status shows delivery errors. Which two configurations must the administrator apply to resolve this issue?

  1. Update the Amazon S3 bucket policy to allow the delivery.logs.amazonaws.com service principal to perform the s3:PutObject and s3:GetBucketAcl actions.Answer
  2. Update the AWS KMS key policy to allow the delivery.logs.amazonaws.com service principal to perform the kms:GenerateDataKey action.Answer
  3. C
    Associate an IAM service role with the flow log that has a trust policy for vpc-flow-logs.amazonaws.com and ensure the administrator has iam:PassRole permission.
  4. D
    Modify the Amazon S3 bucket lifecycle configuration to adjust log retention settings to prevent premature deletion of flow log files.
  5. E
    Create an Amazon EventBridge rule that detects flow log status changes and triggers an AWS Systems Manager Automation runbook to repair the log group stream.

Answer

Update the Amazon S3 bucket policy to allow the delivery.logs.amazonaws.com service principal to perform the s3:PutObject and s3:GetBucketAcl actions, and update the AWS KMS key policy to allow the delivery.logs.amazonaws.com service principal to perform the kms:GenerateDataKey action.
When VPC Flow Logs are delivered to an Amazon S3 bucket, they use the AWS Log Delivery service principal (delivery.logs.amazonaws.com). The target S3 bucket policy must allow this principal to perform s3:PutObject and s3:GetBucketAcl. Additionally, if the bucket is encrypted with a customer managed AWS KMS key, the KMS key policy must allow the delivery.logs.amazonaws.com principal to use the key via kms:GenerateDataKey to encrypt the uploaded log files.

Step-by-Step Solution

1
Determine the destination and encryption requirements for VPC Flow Logs.
The destination is an Amazon S3 bucket encrypted with an AWS KMS customer managed key (SSE-KMS).
Identifying the log destination and encryption status dictates which resource-based policies must be modified.
2
Verify bucket policy requirements for the Log Delivery service principal.
The S3 bucket policy must explicitly grant s3:PutObject and s3:GetBucketAcl to the service principal delivery.logs.amazonaws.com.
AWS services write logs via the Log Delivery service principal, which needs write and permission-check rights on the target bucket.
3
Verify KMS key policy requirements for the Log Delivery service principal.
The KMS key policy for the customer managed key must grant the delivery.logs.amazonaws.com service principal permissions to perform kms:GenerateDataKey.
Since the target bucket uses SSE-KMS, the Log Delivery service needs permissions to generate data keys using that customer managed key to encrypt the logs before writing them to the bucket.

Key Concept

VPC Flow Logs S3 delivery with KMS encryption requires both bucket policy write permissions and KMS key policy generate data key permissions for the Log Delivery service principal.
Rate this question

Topics

VPC Flow Logs and Network Monitoring

More questions from this topic