Examkin

Soru

Zorluk: OrtaMulti-Account Governance and Organizational Structure

An enterprise is designing a multi-account AWS environment using AWS Organizations. The security team requires all CloudTrail logs from all member accounts to be aggregated into a centralized Amazon S3 bucket located in a dedicated Security account. The logs must be encrypted at rest using a Key Management Service (KMS) key. Additionally, member accounts must be prohibited from modifying or disabling the logging configuration. Which of the following configurations should the Solutions Architect implement to meet these requirements? (Select TWO.)

  1. Configure an organization trail in AWS CloudTrail from the management account that sends logs to the centralized S3 bucket in the Security account, and encrypt the logs using a Customer Managed Key (CMK) in the Security account with a key policy that allows the CloudTrail service principal cross-account access.Cevap
  2. Attach a Service Control Policy (SCP) to the organization root that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, and cloudtrail:UpdateTrail actions to prevent member accounts from altering the logging configuration.Cevap
  3. C
    Configure the CloudTrail trail to encrypt logs using the AWS-managed KMS key for Amazon S3 (aws/s3) in the Security account, and update its key policy to allow cross-account access for the member accounts.
  4. D
    Attach a Service Control Policy (SCP) to the member accounts' Organizational Unit (OU) that grants s3:PutObject permissions to the centralized logging bucket, removing the need for local IAM policies.
  5. E
    Configure the centralized S3 bucket policy to allow write access to the management account only, assuming the CloudTrail organization trail uses the management account's credentials to write logs from member accounts.

Cevap

To secure centralized logging in a multi-account environment, the Solutions Architect must deploy an organization trail in AWS CloudTrail using a Customer Managed Key in the Security account with appropriate cross-account permissions, and enforce trail protection by attaching an SCP to the organization root that denies deletion or modification of CloudTrail configurations.
Deploying an organization trail from the management account ensures consistent logging across all member accounts. Since the logs must be encrypted, a Customer Managed Key (CMK) is required in the Security account to permit the cross-account CloudTrail service principal to write encrypted objects. To prevent member accounts from changing this setup, a Service Control Policy (SCP) must be attached to the root of the organization to deny unauthorized modifications to CloudTrail configurations.

Adım Adım Çözüm

1
Set up a centralized S3 bucket in the Security account.
An S3 bucket is prepared with a bucket policy that permits writes from the CloudTrail service principal.
Allows member accounts to centralize their logs securely.
2
Create a Customer Managed Key (CMK) in the Security account.
A CMK is created with a key policy allowing the CloudTrail service principal to perform encrypt/decrypt actions cross-account.
AWS-managed keys cannot be shared across accounts, making a Customer Managed Key necessary for cross-account log encryption.
3
Deploy an AWS CloudTrail Organization Trail.
An organization trail is created from the management account, automatically covering all member accounts.
Ensures that logging is turned on consistently for all existing and future accounts.
4
Create and attach an SCP to the organization root.
An SCP is attached to block modification or deletion of trails in member accounts.
Prevents member account administrators from tampering with or turning off logging.

Anahtar Kavram

Multi-account governance through organization trails, cross-account KMS CMK policies, and Service Control Policies as permission boundaries.
Bu soruyu puanla

Konular

Multi-Account Governance and Organizational Structure

Bu konudan daha fazla soru