Examkin

Soru

Zorluk: OrtaCentralized Monitoring, Logging, and Auditing Solutions

A financial technology company manages 45 member accounts in an AWS Organization. A solutions architect is designing a solution to centralize VPC Flow Logs from all VPCs in the member accounts into a single Amazon S3 bucket located in a dedicated Log Archive account. Security policy dictates that all logs must be encrypted at rest using SSE-KMS. What configuration must the solutions architect implement to allow the logs to be successfully delivered to the centralized S3 bucket?

  1. Configure a Customer Managed Key (CMK) in the Log Archive account with a key policy that grants the AWS Log Delivery service (delivery.logs.amazonaws.com) the kms:GenerateDataKey permission. Apply an S3 bucket policy to the destination bucket that allows the Log Delivery service to perform s3:PutObject actions, restricted by the AWS Organization ID.Cevap
  2. B
    Enable default encryption on the destination S3 bucket using the AWS-managed KMS key (aws/s3) in the Log Archive account. Apply a bucket policy to the S3 bucket that allows the Log Delivery service (delivery.logs.amazonaws.com) to perform s3:PutObject actions.
  3. C
    Create an IAM role in each member account that has permissions to write to the S3 bucket and use the Customer Managed Key (CMK). Configure the VPC Flow Logs in the member accounts to assume this cross-account IAM role to deliver the logs to the central S3 bucket.
  4. D
    Attach a Service Control Policy (SCP) at the Organization root that explicitly allows all member accounts to write to the central S3 bucket and use the Customer Managed Key (CMK). Configure the VPC Flow Logs to publish to the central S3 bucket.

Cevap

Configure a Customer Managed Key (CMK) in the Log Archive account with a key policy that grants the AWS Log Delivery service (delivery.logs.amazonaws.com) the kms:GenerateDataKey permission. Apply an S3 bucket policy to the destination bucket that allows the Log Delivery service to perform s3:PutObject actions, restricted by the AWS Organization ID.
The correct answer correctly identifies that cross-account VPC Flow Logs delivery to Amazon S3 uses the AWS Log Delivery service (delivery.logs.amazonaws.com). Since SSE-KMS encryption is required, a Customer Managed Key (CMK) is necessary because the default AWS-managed key (aws/s3) cannot be modified to grant key access to the Log Delivery service. The bucket policy must also explicitly allow the Log Delivery service to write objects, restricted by the Organization ID.

Adım Adım Çözüm

1
Identify the service delivering VPC Flow Logs to Amazon S3.
The AWS Log Delivery service (delivery.logs.amazonaws.com) is used for direct S3 log delivery.
Knowing which principal performs the delivery determines who needs permissions in the bucket and key policies.
2
Determine S3 bucket policy requirements.
The destination S3 bucket policy must allow s3:PutObject for delivery.logs.amazonaws.com, secured by aws:PrincipalOrgID.
This grants the Log Delivery service access to write the log files while preventing unauthorized external delivery.
3
Determine KMS encryption requirements.
Create a Customer Managed Key (CMK) and grant kms:GenerateDataKey to delivery.logs.amazonaws.com in its policy.
AWS-managed KMS keys (aws/s3) cannot be modified to grant permissions to the Log Delivery service, making a Customer Managed Key necessary.

Anahtar Kavram

Cross-account log delivery using the AWS Log Delivery service requires granting S3 bucket policy permissions and Customer Managed KMS Key (CMK) permissions to the service principal delivery.logs.amazonaws.com, since AWS-managed KMS keys cannot be shared or modified for service-specific cross-account access.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Centralized Monitoring, Logging, and Auditing Solutions

Bu konudan daha fazla soru