Examkin

Soru

Zorluk: Çok zorCentralized Monitoring, Logging, and Auditing Solutions

A logistics company is designing a centralized compliance auditing and log monitoring architecture across its AWS Organization, which currently consists of 120 member accounts. The security team mandates that all AWS CloudTrail logs must be consolidated into a single Amazon S3 bucket located in a dedicated Security account. The architecture must satisfy the following constraints:

- All log data must be encrypted at rest using a customer managed key (CMK) in AWS KMS to meet regulatory requirements.
- The encryption key and S3 bucket must reside in the Security account to isolate auditing assets.
- Administrators in individual member accounts must not be able to modify, disable, or delete the logging configuration, nor should they have access to decrypt or tamper with the logs.
- The configuration must automatically scale to new accounts vended through the organization's automation pipeline.

Which TWO actions should the Solutions Architect take to implement this architecture?

  1. Create a customer managed KMS key and an S3 bucket in the centralized Security account. Configure the KMS key policy to grant the AWS CloudTrail service principal permissions to perform kms:GenerateDataKey* and kms:Decrypt actions, restricted by a condition matching the organization ID. Configure the S3 bucket policy to allow the CloudTrail service principal to perform s3:PutObject and s3:GetBucketAcl actions, conditional on the organization ID.Cevap
  2. Deploy an organization trail from the AWS Organizations management account configured to deliver log files to the centralized S3 bucket, specifying the customer managed KMS key for log encryption. Attach a Service Control Policy (SCP) to the organization root that denies member accounts the permissions to delete, update, or stop CloudTrail configurations.Cevap
  3. C
    Configure the S3 bucket in the centralized Security account to use default encryption with the AWS-managed KMS key (aws/s3). Apply a bucket policy that grants s3:PutObject access to the CloudTrail service principal for all AWS accounts within the organization.
  4. D
    Create an IAM role in each member account that grants permission to write log files to the S3 bucket in the Security account. Configure the organization trail to assume these regional IAM roles to authenticate and deliver the logs, and update the S3 bucket policy in the Security account to trust these IAM roles.
  5. E
    Attach a Service Control Policy (SCP) to the organization root that grants the CloudTrail service principal explicit permissions to write to the centralized S3 bucket and generate data keys using the customer managed KMS key, thereby bypassing local resource policy requirements.

Cevap

To implement this secure centralized auditing configuration, you must create a customer managed KMS key and an S3 bucket in the Security account, configuring both of their resource policies to allow the AWS CloudTrail service principal cross-account access conditional on the organization ID. Additionally, deploy an organization trail from the management account and restrict local tampering via a Service Control Policy (SCP) at the organization root.
The correct implementation combines a centralized S3 bucket and a customer managed KMS key in the Security account with policies that trust the CloudTrail service principal conditional on the organization ID. Deploying an organization trail ensures that all accounts are automatically logged, and a Service Control Policy (SCP) applied at the organization root prevents local administrators from disabling or modifying these logging configurations.

Adım Adım Çözüm

1
Set up the destination storage and encryption in the centralized Security account.
An S3 bucket and a customer managed KMS key are created in the Security account.
Regulatory and security requirements mandate isolating log archives and using a customer managed key where key policy modifications are possible.
2
Configure the S3 bucket policy and KMS key policy to permit cross-account log delivery.
The S3 bucket policy allows s3:PutObject and s3:GetBucketAcl, and the KMS key policy allows kms:GenerateDataKey* and kms:Decrypt for the CloudTrail service principal, conditional on the organization ID.
Since CloudTrail delivers logs from various accounts under the organization, the resource policies must explicitly trust the service principal using the aws:PrincipalOrgID condition.
3
Create an organization trail in the management account to log events across all member accounts.
An organization trail is deployed that directs logs to the S3 bucket and encrypts them using the customer managed KMS key.
An organization trail automatically applies to all existing and future accounts, ensuring complete coverage without manual configuration for new accounts.
4
Apply a Service Control Policy (SCP) at the organization root.
An SCP is attached to deny member accounts permission to modify or delete CloudTrail resources.
This prevents local administrators in member accounts from stopping logging, disabling trails, or deleting logging configurations.

Anahtar Kavram

Centralized Organization Trail logging with cross-account KMS CMK encryption and S3 bucket policies.
Bu soruyu puanla

Konular

Centralized Monitoring, Logging, and Auditing Solutions

Bu konudan daha fazla soru