Examkin

Soru

Zorluk: KolayImproving Operational Excellence via Monitoring and Logging

An enterprise wants to centralize API activity logs across all AWS accounts in their AWS Organization. A solutions architect configures an organization trail in the management account to deliver logs to a centralized Amazon S3 bucket located in a dedicated security account. The S3 bucket uses Amazon S3 managed keys (SSE-S3) for encryption. Although the organization trail is successfully created, the operations team reports that no log files are being delivered to the S3 bucket. Which of the following is the most likely cause of this issue?

  1. The S3 bucket policy in the security account does not grant write permissions to the CloudTrail service principal for the organization path structure.Cevap
  2. B
    The S3 bucket policy in the security account only grants access to local IAM users, under the assumption that member accounts automatically inherit write access through AWS Organizations.
  3. C
    The unified CloudWatch agent on the management account has not been configured with the correct log file path pattern to match the rotated CloudTrail log files.
  4. D
    The default AWS managed key (aws/s3) is being used to encrypt the S3 bucket, preventing CloudTrail from performing cross-account encryption due to key policy restrictions.

Cevap

The S3 bucket policy in the security account does not grant write permissions to the CloudTrail service principal for the organization path structure.
AWS CloudTrail delivers logs to S3 using its service principal (cloudtrail.amazonaws.com). When centralizing logs from an organization trail into a bucket located in another account, the destination S3 bucket policy must explicitly permit the CloudTrail service principal to perform the s3:PutObject action on the path corresponding to the AWS Organization's logs (typically prefixed with AWSLogs/o-organizationid/). Without this permission, CloudTrail will be blocked from writing to the bucket.

Adım Adım Çözüm

1
Identify the service delivering logs and the destination bucket's location.
AWS CloudTrail is configured in the management account, and the destination S3 bucket is in a separate security account.
Since the bucket is in a different account, cross-account permissions must be explicitly granted.
2
Determine how CloudTrail delivers logs to Amazon S3.
CloudTrail uses its service principal (cloudtrail.amazonaws.com) to write logs directly to the S3 bucket.
Log delivery relies on the bucket policy allowing the CloudTrail service principal rather than individual IAM users or roles.
3
Verify if the bucket policy is properly configured for the organization trail structure.
The bucket policy must grant s3:PutObject permissions to cloudtrail.amazonaws.com for the prefix matching the organization's ID.
Without this resource-based policy permission, CloudTrail cannot write logs to the S3 bucket in the security account, resulting in delivery failure.

Anahtar Kavram

Cross-account log centralization with AWS CloudTrail and S3 bucket policies
Bu soruyu puanla

Konular

Improving Operational Excellence via Monitoring and Logging