Examkin

Soru

Zorluk: ZorCentralized Monitoring, Logging, and Auditing Solutions

A media streaming company with 4545 AWS accounts organized under a single organization in AWS Organizations needs to implement a centralized auditing architecture. The security team requires that all API activity across all current and future accounts and regions be recorded using AWS CloudTrail. The logs must be consolidated in a centralized Amazon S3 bucket within a dedicated Security account. The logs must be encrypted using a Customer Managed Key (CMK) in AWS Key Management Service (AWS KMS) that is owned and managed by the Security account. Additionally, member account administrators must be prevented from modifying or deleting the CloudTrail configuration. Which of the following architectures meets these requirements with the least operational overhead?

  1. A
    Create an organization trail from the AWS Organizations management account to write logs directly to the Security account's S3 bucket. Rather than modifying the S3 bucket policy in the Security account, attach a Service Control Policy (SCP) to the root of the organization that allows s3:PutObject access for all member accounts to the Security account's S3 bucket, and rely on IAM policy inheritance to grant write access.
  2. Configure an organization trail from the AWS Organizations management account to deliver logs to the S3 bucket in the Security account. In the Security account, update the S3 bucket policy to allow the cloudtrail.amazonaws.com service principal to perform s3:GetBucketAcl and s3:PutObject actions, restricted to the organization's S3 prefix path. Configure the KMS key policy for the Customer Managed Key (CMK) in the Security account to allow the cloudtrail.amazonaws.com service principal to use the key with a condition restricting access to the organization's CloudTrail ARNs. Apply a Service Control Policy (SCP) at the Organization root that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, and cloudtrail:UpdateTrail actions.Cevap
  3. C
    Configure individual trails in each of the 4545 member accounts to deliver logs to local S3 buckets. Enable S3 Cross-Region Replication (CRR) to copy all log objects to the centralized S3 bucket in the Security account. Encrypt the destination S3 bucket using the AWS-managed KMS key (aws/s3) to avoid managing custom key policies, and attach a Service Control Policy (SCP) to the organization root that denies member accounts the ability to modify replication configurations.
  4. D
    Configure an organization trail from the AWS Organizations management account to deliver logs to the Security account's S3 bucket. Update the S3 bucket policy in the Security account to allow s3:PutObject and s3:GetBucketAcl actions to all IAM users within the member accounts by specifying the wildcard * principal combined with the aws:PrincipalOrgID condition. Set up the KMS CMK key policy in the Security account to grant kms:GenerateDataKey* permissions to the member accounts' IAM roles.

Cevap

Configure an organization trail from the AWS Organizations management account to deliver logs to the S3 bucket in the Security account. In the Security account, update the S3 bucket policy to allow the cloudtrail.amazonaws.com service principal to perform s3:GetBucketAcl and s3:PutObject actions, restricted to the organization's S3 prefix path. Configure the KMS key policy for the Customer Managed Key (CMK) in the Security account to allow the cloudtrail.amazonaws.com service principal to use the key with a condition restricting access to the organization's CloudTrail ARNs. Apply a Service Control Policy (SCP) at the Organization root that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, and cloudtrail:UpdateTrail actions.
The correct architecture uses an Organization Trail which automatically deploys logging to all member accounts. The Security account S3 bucket policy and KMS key policy correctly target the 'cloudtrail.amazonaws.com' service principal, which is required because the CloudTrail service itself writes the logs. The SCP at the root OUs prevents local administrators from disabling this logging, securing the audit trail.

Adım Adım Çözüm

1
Select the centralized log collection mechanism.
An organization trail is chosen to cover all 4545 accounts automatically (including future accounts) with minimal operational overhead.
Creating individual trails in member accounts increases configuration drift risks and administrative overhead.
2
Configure permissions for the S3 bucket and KMS CMK in the Security account.
The S3 bucket policy and KMS key policy are updated to trust the 'cloudtrail.amazonaws.com' service principal.
CloudTrail is an AWS service that delivers logs directly; it does not assume IAM roles from member accounts to perform writes, so the service principal must be granted direct permission.
3
Enforce compliance using Service Control Policies (SCPs).
An SCP is attached to the Organization root to deny destructive actions like 'cloudtrail:StopLogging' and 'cloudtrail:DeleteTrail' to member accounts.
SCPs act as a centralized guardrail to prevent member account administrators from disabling organization-wide logging.

Anahtar Kavram

Centralized Organization Trail with S3, KMS CMK, and SCP guardrails
Bu soruyu puanla

Konular

Centralized Monitoring, Logging, and Auditing Solutions

Bu konudan daha fazla soru