Examkin

Question

Difficulty: Very hardSecurity Monitoring, Logging, and Compliance Auditing

A SysOps Administrator is setting up an organization-wide trail in AWS CloudTrail to log API activity across all member accounts. The trail is configured to deliver logs to a centralized Amazon S3 bucket in a dedicated security account. The S3 bucket is encrypted using SSE-KMS with a customer managed key. The S3 bucket policy is already configured to allow the `cloudtrail.amazonaws.com` service principal to perform `s3:GetBucketAcl` and `s3:PutObject` actions. However, the Administrator notices that no log files are being delivered to the S3 bucket, and the CloudTrail console displays a log delivery error. Which action must the SysOps Administrator take to resolve this log delivery issue?

  1. Update the key policy of the customer managed KMS key in the security account to grant the `cloudtrail.amazonaws.com` service principal permissions to perform `kms:GenerateDataKey*` and `kms:DescribeKey` actions.Answer
  2. B
    Create an IAM role in the organization's management account with a trust policy allowing `cloudtrail.amazonaws.com`, attach a policy with `kms:GenerateDataKey*` permissions, and associate this role with the CloudTrail configuration.
  3. C
    Modify the S3 bucket policy in the security account to grant the `cloudtrail.amazonaws.com` service principal the `kms:GenerateDataKey*` and `kms:Decrypt` permissions directly in the bucket policy's statement.
  4. D
    Modify the KMS key policy to grant the Amazon S3 service principal (`s3.amazonaws.com`) `kms:Decrypt` and `kms:GenerateDataKey*` permissions, since Amazon S3 manages the encryption of objects written to the bucket.

Answer

Update the key policy of the customer managed KMS key in the security account to grant the `cloudtrail.amazonaws.com` service principal permissions to perform `kms:GenerateDataKey*` and `kms:DescribeKey` actions.
To successfully deliver logs to an S3 bucket encrypted with a customer managed KMS key, the CloudTrail service principal (`cloudtrail.amazonaws.com`) must have explicit permission to use that key. This is done by modifying the KMS key policy to allow the service principal to perform the `kms:GenerateDataKey*` and `kms:DescribeKey` actions. Without this, CloudTrail cannot encrypt the logs, resulting in log delivery failure.

Step-by-Step Solution

1
Identify the root cause of the CloudTrail log delivery failure when using SSE-KMS encryption.
The failure occurs because CloudTrail lacks the required permissions to generate an encryption key using the customer managed KMS key.
When CloudTrail delivers logs to a bucket encrypted with SSE-KMS using a customer managed key, CloudTrail must be able to use that key to encrypt the logs before uploading them.
2
Verify where KMS key permissions must be declared.
KMS key permissions must be configured in the KMS key policy itself, as S3 bucket policies cannot govern KMS actions.
An S3 bucket policy only supports S3 API actions. Any KMS access control must be explicitly defined in the customer managed KMS key's key policy.
3
Identify the required KMS API permissions and the correct principal.
The CloudTrail service principal (`cloudtrail.amazonaws.com`) requires `kms:GenerateDataKey*` and `kms:DescribeKey` permissions.
CloudTrail uses `kms:GenerateDataKey*` to generate a unique data key for encrypting each log file, and `kms:DescribeKey` to check the key properties. Using the correct service principal ensures CloudTrail can execute these operations directly.

Key Concept

AWS CloudTrail SSE-KMS Encryption Key Policies
Rate this question

Topics

Security Monitoring, Logging, and Compliance Auditing

More questions from this topic