Examkin

Soru

Zorluk: OrtaCentralized Monitoring, Logging, and Auditing Solutions

A financial services company manages 4545 member accounts within an AWS Organization. The security team is setting up an organization-wide AWS CloudTrail trail to log all API activity to a centralized Amazon S3 bucket located in a dedicated Security account. The S3 bucket must be encrypted using a Customer Managed Key (CMK) in AWS Key Management Service (AWS KMS) to comply with regulatory standards. Which combination of configuration steps will ensure that CloudTrail can successfully write logs from all member accounts to the central S3 bucket?

  1. Configure the S3 bucket policy in the Security account to permit the CloudTrail service principal to write objects, restricted by the AWS Organization ID. Attach a key policy to the Customer Managed Key in the Security account that allows the CloudTrail service principal to generate data keys, restricted by the AWS Organization ID.Cevap
  2. B
    Configure the S3 bucket policy in the Security account to permit the CloudTrail service principal to write objects, restricted by the AWS Organization ID. Configure S3 default encryption using the AWS managed key 'aws/s3' to automatically encrypt all delivered log files.
  3. C
    Configure IAM roles in the member accounts that grant the CloudTrail service principal permission to write directly to the S3 bucket in the Security account, without modifying the destination S3 bucket policy.
  4. D
    Attach a Service Control Policy (SCP) to the organization root that grants CloudTrail the necessary 's3:PutObject' and 'kms:GenerateDataKey' permissions to write to the central S3 bucket and use the Customer Managed Key.

Cevap

Configure the S3 bucket policy in the Security account to permit the CloudTrail service principal to write objects, restricted by the AWS Organization ID. Attach a key policy to the Customer Managed Key in the Security account that allows the CloudTrail service principal to generate data keys, restricted by the AWS Organization ID.
The correct answer correctly addresses both S3 bucket access and KMS encryption. The S3 bucket policy in the target Security account must allow the CloudTrail service principal to write logs, and the KMS key policy for the Customer Managed Key must allow the same principal to generate data keys to encrypt those logs. Using the AWS Organization ID as a condition scope maintains security control across all member accounts.

Adım Adım Çözüm

1
Analyze bucket policy requirements for centralized S3 logging
The destination S3 bucket policy in the Security account must explicitly allow 's3:PutObject' and 's3:GetBucketAcl' for the CloudTrail service principal ('cloudtrail.amazonaws.com') to permit writes from all organization member accounts.
Since the bucket is in a different account than the member accounts, cross-account access must be configured via the S3 bucket policy.
2
Analyze KMS encryption requirements for cross-account CloudTrail logs
The Customer Managed Key (CMK) key policy must grant permissions for the CloudTrail service principal to perform 'kms:GenerateDataKey*' and 'kms:Decrypt' operations.
AWS-managed keys cannot be used for cross-account access because their key policies are not modifiable. A Customer Managed Key is required.
3
Apply organizational restrictions for security boundaries
Use conditions like 'aws:PrincipalOrgID' or 'aws:SourceArn' in both the S3 bucket policy and KMS key policy to restrict access to the specific AWS Organization.
This prevents unauthorized accounts outside the organization from writing to the bucket or using the key.

Anahtar Kavram

Centralized cross-account logging requires configuring both resource policies (S3 bucket policy) and KMS key policies to trust the AWS service principal, restricted by organizational boundaries.
Bu soruyu puanla

Konular

Centralized Monitoring, Logging, and Auditing Solutions

Bu konudan daha fazla soru