An enterprise with 75 member accounts in AWS Organizations wants to centralize VPC Flow Logs from all VPCs into an Amazon S3 bucket located in a dedicated Security account. The logs must be encrypted at rest using a Customer Managed Key (CMK) in AWS KMS to comply with security requirements. The security team must prevent member account administrators from deleting or modifying the flow log configurations. Which TWO actions should the Solutions Architect perform to meet these requirements?
- In the Security account, configure the S3 bucket policy to allow the delivery.logs.amazonaws.com service principal s3:PutObject and s3:GetBucketAcl permissions. Update the key policy of the Customer Managed Key to grant kms:GenerateDataKey* and kms:DescribeKey permissions to the same service principal.Cevap
- Create a Service Control Policy (SCP) and attach it to the Organization root that denies ec2:DeleteFlowLogs and ec2:CreateFlowLogs actions across all member accounts, with a condition that excludes a centralized provisioning IAM role used by the platform team.Cevap
- CIn the Security account, configure the S3 bucket policy to allow the delivery.logs.amazonaws.com service principal s3:PutObject and s3:GetBucketAcl permissions. Enable default bucket encryption using the AWS-managed key aws/s3 to simplify key sharing across the Organization.
- DConfigure the S3 bucket policy in the Security account to allow s3:PutObject and s3:GetBucketAcl actions for the IAM roles in member accounts, using a condition that matches aws:PrincipalOrgID to authorize all accounts in the organization.
- ECreate a Service Control Policy (SCP) and attach it to the Organization root that grants the security account's logging role permissions to create and manage Flow Logs in member accounts, thereby bypassing local IAM policy requirements.
Cevap
Configure the S3 bucket policy and KMS key policy to trust the VPC Flow Logs service principal for delivery, and apply an SCP that denies flow log modification while excluding a centralized provisioning role.
Centralizing VPC Flow Logs requires configuring the destination S3 bucket policy and Customer Managed Key (CMK) key policy in the Security account to trust the VPC Flow Logs service principal (delivery.logs.amazonaws.com). Applying an SCP at the Organization root prevents member account administrators from deleting or disabling the flow logs, while excluding a dedicated automation role ensures that centralized tooling can still configure the logs.
Adım Adım Çözüm
Anahtar Kavram
Centralized VPC Flow Logs delivery requires authorizing the delivery.logs.amazonaws.com service principal in both the S3 bucket policy and the Customer Managed Key (CMK) policy. Security guardrails to prevent modification should be enforced via SCPs with appropriate exceptions.