Examkin

Question

Difficulty: HardAWS CloudTrail Configuration and Management

A SysOps Administrator is troubleshooting an issue where a newly configured AWS CloudTrail trail is failing to deliver logs to a centralized Amazon S3 bucket. The trail is configured to encrypt log files using an AWS Key Management Service (AWS KMS) customer managed key. The S3 bucket policy is verified to correctly permit the 'cloudtrail.amazonaws.com' service principal to write objects. However, log delivery is failing, and the CloudTrail console displays an access denied error related to encryption. Which modification will resolve this log delivery issue?

  1. A
    Modify the S3 bucket policy to include 'kms:GenerateDataKey*' and 'kms:Decrypt' in the list of allowed actions for the 'cloudtrail.amazonaws.com' service principal.
  2. Modify the KMS key policy to allow the 'cloudtrail.amazonaws.com' service principal to perform 'kms:GenerateDataKey*' and 'kms:DescribeKey' actions, using the 'aws:SourceArn' or encryption context conditions to restrict access to the trail.Answer
  3. C
    Create an IAM role with a policy allowing the 'kms:GenerateDataKey*' action, attach it to the trail using the 'iam:PassRole' permission, and configure the KMS key to trust this role.
  4. D
    Update the KMS key policy to delegate key administration to the S3 bucket owner by adding the bucket owner's account root principal to the key's administrator list.

Answer

Modify the KMS key policy to allow the 'cloudtrail.amazonaws.com' service principal to perform 'kms:GenerateDataKey*' and 'kms:DescribeKey' actions, using the 'aws:SourceArn' or encryption context conditions to restrict access to the trail.
The correct solution is to modify the KMS key policy to grant the 'cloudtrail.amazonaws.com' service principal permissions for 'kms:GenerateDataKey*' and 'kms:DescribeKey'. Because CloudTrail encrypts logs on the client side before delivering them to S3, it must have direct permission to use the customer managed key. Adding conditions like 'aws:SourceArn' or 'kms:EncryptionContext:aws:cloudtrail:arn' prevents unauthorized use of the key by other trails or accounts.

Step-by-Step Solution

1
Identify the resource where the access denied error is occurring.
The error is related to encryption, indicating the issue is with the KMS key policy rather than the S3 bucket policy.
The S3 bucket policy is already verified as correct, so the block is at the KMS key level.
2
Determine the principal and actions required for CloudTrail log encryption.
CloudTrail needs to call 'kms:GenerateDataKey*' to generate data keys for encryption and 'kms:DescribeKey' to obtain key metadata.
CloudTrail encrypts logs using the customer managed key on the client side before uploading them to the S3 bucket.
3
Configure the KMS key policy to grant the necessary permissions.
Add a statement allowing 'cloudtrail.amazonaws.com' the identified actions with condition keys like 'aws:SourceArn' to secure the key.
Key policies are the primary authorization mechanism for KMS customer managed keys.

Key Concept

AWS KMS Key Policies for CloudTrail Encryption
Rate this question

Topics

AWS CloudTrail Configuration and Management

More questions from this topic