A company is implementing a centralized logging strategy across its multi-account AWS environment managed by AWS Organizations. The security team has configured an organization trail to deliver log files from all member accounts to a centralized Amazon S3 bucket in a dedicated Security account. To comply with corporate data protection standards, all logs stored in the S3 bucket must be encrypted at rest using an AWS KMS key. Currently, CloudTrail is failing to deliver the log files to the S3 bucket. Which configuration will resolve this issue and meet the compliance requirements using the principle of least privilege?
- AConfigure the S3 bucket default encryption to use the AWS-managed KMS key for S3 (aws/s3) in the Security account. Update the S3 bucket policy to grant the AWS CloudTrail service principal permissions to perform s3:PutObject and s3:GetBucketAcl using the aws:PrincipalOrgID condition. Modify the key policy of the AWS-managed KMS key to allow the CloudTrail service principal to perform key operations.
- Create a Customer Managed Key (CMK) in the Security account. Configure the CMK's key policy to grant the AWS CloudTrail service principal permissions to perform kms:GenerateDataKey* and kms:DescribeKey operations, restricted to the organization's trail ARN. Update the S3 bucket policy in the Security account to grant the CloudTrail service principal permissions to perform s3:PutObject and s3:GetBucketAcl using the aws:PrincipalOrgID condition, and set the S3 bucket's default encryption to use the CMK.Cevap
- CCreate a Service Control Policy (SCP) at the root level of the organization that explicitly grants the cloudtrail.amazonaws.com service principal access to the default AWS-managed KMS key (aws/s3) in the Security account. Update the S3 bucket policy in the Security account to allow s3:PutObject and s3:GetBucketAcl actions from all member accounts in the organization.
- DCreate a Customer Managed Key (CMK) in the Security account with a key policy that allows member accounts to use the key. Update the S3 bucket policy in the Security account to grant s3:PutObject and s3:GetBucketAcl permissions to the IAM roles of the member accounts, rather than the CloudTrail service principal, assuming the member accounts write the logs directly.
Cevap
Create a Customer Managed Key (CMK) in the Security account, granting the AWS CloudTrail service principal permissions to perform kms:GenerateDataKey* and kms:DescribeKey operations in the key policy. Configure the S3 bucket policy to allow the CloudTrail service principal to perform s3:PutObject and s3:GetBucketAcl actions with an organization condition, and configure S3 default encryption to use the CMK.
The correct solution involves creating a Customer Managed Key (CMK) in the Security account because AWS-managed keys cannot have their key policies modified and do not support cross-account sharing. The CMK's key policy must permit the CloudTrail service principal to perform key operations (kms:GenerateDataKey* and kms:DescribeKey) so it can encrypt the logs. Additionally, the S3 bucket policy must grant the CloudTrail service principal permissions to perform s3:PutObject and s3:GetBucketAcl using the aws:PrincipalOrgID condition to restrict access to only member accounts within the Organization.
Adım Adım Çözüm
Anahtar Kavram
Cross-account log delivery with S3 and KMS key management requires a Customer Managed Key (CMK) because AWS-managed keys cannot be shared cross-account, and the S3 bucket policy and KMS key policy must explicitly authorize the CloudTrail service principal.