Examkin

Question

Difficulty: MediumAWS CloudTrail Configuration and Management

A SysOps Administrator is configuring a new AWS CloudTrail trail to deliver management events to an Amazon S3 bucket. The logs must be encrypted using an AWS Key Management Service (AWS KMS) customer managed key (SSE-KMS), and log file integrity validation must be enabled. Which actions must the SysOps Administrator take to configure this log delivery and encryption? (Select two.)

  1. Configure the Amazon S3 bucket policy to allow the AWS CloudTrail service principal to perform s3:PutObject and s3:GetBucketAcl actions.Answer
  2. Configure the AWS KMS key policy to allow the AWS CloudTrail service principal to perform kms:GenerateDataKey* and kms:DescribeKey actions.Answer
  3. C
    Attach an IAM policy to the administrator's IAM group that grants kms:Encrypt and kms:GenerateDataKey permissions on the customer managed key.
  4. D
    Create an IAM service role for CloudTrail with Amazon S3 write access, and specify the role in the trail's configuration settings.
  5. E
    Create an Amazon EventBridge rule that detects CloudTrail log uploads and triggers an AWS Systems Manager Automation workflow to encrypt the log files.

Answer

Configure the Amazon S3 bucket policy to allow the AWS CloudTrail service principal to perform s3:PutObject and s3:GetBucketAcl actions, and configure the AWS KMS key policy to allow the AWS CloudTrail service principal to perform kms:GenerateDataKey* and kms:DescribeKey actions.
To successfully deliver and encrypt logs, the Amazon S3 bucket policy must explicitly permit the AWS CloudTrail service principal (cloudtrail.amazonaws.com) to write log files using s3:PutObject and check bucket ACLs using s3:GetBucketAcl. Concurrently, the AWS KMS key policy must permit the same service principal to execute kms:GenerateDataKey* to obtain data encryption keys and kms:DescribeKey to check the key's state.

Step-by-Step Solution

1
Ensure the target Amazon S3 bucket policy permits the AWS CloudTrail service principal (cloudtrail.amazonaws.com) to execute s3:PutObject for writing logs and s3:GetBucketAcl to verify bucket owner control.
The S3 bucket will accept logs delivered by the CloudTrail service without permission errors.
CloudTrail must verify ownership of the bucket before writing log files to avoid data loss or delivery failures.
2
Modify the AWS KMS key policy of the customer managed key to allow the cloudtrail.amazonaws.com service principal to run kms:GenerateDataKey* and kms:DescribeKey actions.
CloudTrail can generate unique data keys to encrypt each log object natively using SSE-KMS.
CloudTrail uses key policy delegation to encrypt logs at rest directly, as it cannot rely on user-level IAM policies for background service operations.

Key Concept

Configuring S3 bucket policies and KMS key policies for AWS CloudTrail log delivery
Rate this question

Topics

AWS CloudTrail Configuration and Management

More questions from this topic