Examkin

Soru

Zorluk: ZorCentralized Monitoring, Logging, and Auditing Solutions

A financial services corporation is implementing a centralized governance model for its AWS environment, which consists of 65 member accounts managed under AWS Organizations. The security team requires a centralized logging architecture that aggregates all AWS CloudTrail logs across all accounts and regions into a single Amazon S3 bucket. The S3 bucket will reside in a dedicated Log Archive account. The solution must ensure that all log files are encrypted at rest using a customer managed KMS key, and log integrity validation must be enabled. Additionally, member accounts must be prevented from disabling CloudTrail logging or altering the centralized trail configuration, while developers in the member accounts must retain their existing administrative permissions. Which combination of configurations will meet these requirements?

  1. A
    Create an organizational trail in AWS CloudTrail from the management account, configured to send logs to the central S3 bucket in the Log Archive account. Configure the S3 bucket policy to grant s3:PutObject and s3:GetBucketAcl permissions to the cloudtrail.amazonaws.com service principal. Enable default S3 bucket encryption using the AWS-managed KMS key (aws/s3) in the Log Archive account. Apply a Service Control Policy (SCP) to the member accounts' Organizational Unit (OU) that denies the cloudtrail:DeleteTrail, cloudtrail:UpdateTrail, and cloudtrail:StopLogging actions.
  2. B
    Create an organizational trail in AWS CloudTrail from the management account, configured to send logs to the central S3 bucket in the Log Archive account. Create a customer managed KMS key in the Log Archive account, and configure its key policy to allow the cloudtrail.amazonaws.com service principal to perform kms:GenerateDataKey* and kms:DescribeKey operations. Grant S3 bucket access by creating an IAM policy in each member account that allows s3:PutObject to the central S3 bucket, and configure the S3 bucket policy to allow read/write access to the root user of each member account. Apply a Service Control Policy (SCP) to the member accounts' Organizational Unit (OU) that denies the cloudtrail:DeleteTrail, cloudtrail:UpdateTrail, and cloudtrail:StopLogging actions.
  3. Create an organizational trail in AWS CloudTrail from the management account, configured to send logs to the central S3 bucket in the Log Archive account. Configure the S3 bucket policy in the Log Archive account to grant s3:PutObject and s3:GetBucketAcl permissions to the cloudtrail.amazonaws.com service principal. Create a customer managed KMS key in the Log Archive account, and configure its key policy to allow the cloudtrail.amazonaws.com service principal to perform kms:GenerateDataKey* and kms:DescribeKey operations. Apply a Service Control Policy (SCP) to the member accounts' Organizational Unit (OU) that denies the cloudtrail:DeleteTrail, cloudtrail:UpdateTrail, and cloudtrail:StopLogging actions.Cevap
  4. D
    Create an organizational trail in AWS CloudTrail from the management account, configured to send logs to the central S3 bucket in the Log Archive account. Configure the S3 bucket policy to grant s3:PutObject and s3:GetBucketAcl permissions to the cloudtrail.amazonaws.com service principal. Create a customer managed KMS key in the Log Archive account. Attach a Service Control Policy (SCP) with an Allow statement for cloudtrail:* and kms:* to the member accounts' Organizational Unit (OU) to grant the member accounts the permission to write logs to the S3 bucket and use the KMS key, without modifying the KMS key policy.

Cevap

Create an organizational trail in AWS CloudTrail, configure the destination S3 bucket policy to trust the CloudTrail service principal, use a customer managed KMS key with a key policy that allows the CloudTrail service principal to generate data keys, and use an SCP to deny trail modification.
The correct solution involves creating an organizational trail from the management account, which centralizes the logs in the S3 bucket. The S3 bucket policy must allow the cloudtrail.amazonaws.com service principal to write objects to the bucket. Because the logs are encrypted using a customer managed KMS key in the Log Archive account, the KMS key policy must explicitly allow the cloudtrail.amazonaws.com service principal to generate data keys and describe the key. Finally, the Service Control Policy (SCP) is applied to the member accounts to prevent disabling or modifying the trail.

Adım Adım Çözüm

1
Determine the logging strategy scope.
Create an organizational trail from the management account of the organization.
An organizational trail automatically ensures that events from all regions and member accounts are logged and consolidated.
2
Configure the S3 bucket policy.
Grant s3:PutObject and s3:GetBucketAcl permissions to the cloudtrail.amazonaws.com service principal.
CloudTrail log delivery is performed by the CloudTrail service principal, which needs cross-account access to write to the Log Archive S3 bucket.
3
Configure the encryption strategy.
Create a customer managed KMS key in the Log Archive account and modify its key policy to allow the cloudtrail.amazonaws.com service principal to execute kms:GenerateDataKey* and kms:DescribeKey.
AWS-managed KMS keys do not support policy modification and cannot be shared cross-account, so a customer managed key is required to permit cross-account encryption by CloudTrail.
4
Apply governance guardrails.
Attach an SCP to the member accounts' OU that denies destructive CloudTrail actions.
SCPs define boundary permissions for member accounts, preventing developers with admin privileges from disabling or deleting the trail while maintaining their administrative access.

Anahtar Kavram

Cross-account centralized CloudTrail logging with KMS CMK encryption and SCP guardrails
Bu soruyu puanla

Konular

Centralized Monitoring, Logging, and Auditing Solutions

Bu konudan daha fazla soru