Examkin

Question

Difficulty: Very hardVPC Flow Logs and Network Monitoring

A SysOps Administrator is setting up VPC Flow Logs in Account A to publish network traffic metadata to an Amazon S3 bucket in Account B. The S3 bucket in Account B is configured with default encryption using a customer managed AWS KMS key. The flow logs are failing to deliver to the S3 bucket. Which of the following actions must be taken to successfully deliver the flow logs to the destination S3 bucket? (Select TWO.)

  1. Modify the S3 bucket policy in Account B to allow the delivery.logs.amazonaws.com service principal to perform s3:PutObject and s3:GetBucketAcl actions.Answer
  2. Modify the customer managed KMS key policy in Account B to grant the delivery.logs.amazonaws.com service principal the kms:GenerateDataKey* permission.Answer
  3. C
    Create an IAM role in Account A with a trust policy for the vpc-flow-logs.amazonaws.com service principal, attach a policy with s3:PutObject permissions for the bucket in Account B, and associate this role with the flow log configuration.
  4. D
    Modify the policy of the default AWS managed KMS key (aws/s3) in Account B to allow the delivery.logs.amazonaws.com service principal to perform kms:GenerateDataKey* operations.
  5. E
    In Account A, create an IAM role containing the iam:PassRole permission for the log delivery service, and assign the role to the VPC flow log creation request.

Answer

To deliver cross-account VPC Flow Logs to an S3 bucket encrypted with a customer managed KMS key, the administrator must modify the S3 bucket policy in Account B to allow delivery.logs.amazonaws.com to perform s3:PutObject and s3:GetBucketAcl, and modify the customer managed KMS key policy in Account B to allow delivery.logs.amazonaws.com to perform kms:GenerateDataKey*.
To publish cross-account VPC Flow Logs to an S3 bucket encrypted with a customer managed KMS key, two permissions must be configured. First, the S3 bucket policy in Account B must allow the delivery.logs.amazonaws.com service principal to write objects (s3:PutObject) and read the bucket ACL (s3:GetBucketAcl). Second, the KMS key policy of the customer managed key in Account B must grant the delivery.logs.amazonaws.com service principal the kms:GenerateDataKey* permission to allow encryption of the log files upon delivery.

Step-by-Step Solution

1
Analyze the destination requirements for VPC Flow Logs publishing to S3.
Identify that VPC Flow Logs uses the log delivery service (delivery.logs.amazonaws.com) to write logs to S3 and does not use an IAM role.
This determines that configurations must be done using resource-based policies rather than creating client-side IAM roles.
2
Configure the bucket policy in Account B.
The bucket policy is updated to grant s3:PutObject and s3:GetBucketAcl to delivery.logs.amazonaws.com.
This grants the cross-account service permission to write the log files to the S3 bucket.
3
Address the S3 encryption requirement.
The customer managed KMS key policy is updated to grant kms:GenerateDataKey* to delivery.logs.amazonaws.com.
Because the S3 bucket uses customer managed KMS encryption, the log delivery service must be allowed to generate data keys to encrypt objects as it writes them.

Key Concept

Cross-account VPC Flow Logs delivery to an encrypted Amazon S3 bucket requires resource-based permissions (bucket policy and KMS key policy) for the Log Delivery service principal (delivery.logs.amazonaws.com), rather than user-configured IAM roles.
Rate this question

Topics

VPC Flow Logs and Network Monitoring

More questions from this topic