Examkin

Soru

Zorluk: OrtaMulti-Account Governance and Organizational Structure

A software-as-a-service (SaaS) provider uses AWS Organizations to manage multiple AWS accounts. The security team wants to centralize AWS CloudTrail logs from all member accounts into a single Amazon S3 bucket located in a dedicated Security account. The security policy dictates that the logs must be encrypted at rest using an AWS Key Management Service (KMS) key. Which strategy should the solutions architect implement to configure this logging and encryption mechanism with the least operational complexity?

  1. A
    Configure the S3 bucket in the Security account with a bucket policy allowing the CloudTrail service principal to write objects. Encrypt the bucket using the AWS-managed KMS key for Amazon S3 (aws/s3) in the Security account, and grant the member accounts access to this key.
  2. B
    Attach a Service Control Policy (SCP) at the organization root that explicitly grants CloudTrail permission to write objects to the central S3 bucket, and configure member accounts to use this SCP instead of local S3 bucket policies.
  3. Configure the S3 bucket in the Security account with a bucket policy allowing the CloudTrail service principal to write objects, using the aws:PrincipalOrgID condition to restrict access to the organization. Encrypt the bucket using a Customer Managed Key (CMK) in the Security account, with a key policy that grants CloudTrail permissions to generate data keys and decrypt.Cevap
  4. D
    Configure the S3 bucket in the Security account with a bucket policy that allows write access to the Root account of the organization, assuming this trust relationship automatically allows CloudTrail to deliver logs from any member account without specifying the CloudTrail service principal.

Cevap

Configure the S3 bucket in the Security account with a bucket policy allowing the CloudTrail service principal to write objects, using the aws:PrincipalOrgID condition to restrict access to the organization. Encrypt the bucket using a Customer Managed Key (CMK) in the Security account, with a key policy that grants CloudTrail permissions to generate data keys and decrypt.
The correct strategy requires configuring a resource-based S3 bucket policy in the Security account that explicitly allows the CloudTrail service principal (`cloudtrail.amazonaws.com`) to write objects, restricted to the organization using the `aws:PrincipalOrgID` condition. Additionally, because AWS-managed keys (like `aws/s3`) cannot have their key policies modified for cross-account access, a Customer Managed Key (CMK) must be used. The CMK's key policy must explicitly allow the CloudTrail service principal to perform `kms:GenerateDataKey*` and `kms:Decrypt` operations.

Adım Adım Çözüm

1
Set up a centralized S3 bucket in the Security account.
An S3 bucket is created to store logs from all member accounts.
This establishes the target storage for cross-account logging.
2
Apply a bucket policy allowing the CloudTrail service principal to perform s3:PutObject, using aws:PrincipalOrgID in the condition block.
CloudTrail from any account belonging to the organization can write logs to the bucket.
This restricts access to the organization's member accounts while allowing the CloudTrail service principal to write objects.
3
Create a Customer Managed Key (CMK) in the Security account with a policy allowing CloudTrail to execute kms:GenerateDataKey* and kms:Decrypt.
CloudTrail service in member accounts is authorized to use the KMS key to encrypt log files.
AWS-managed keys (such as aws/s3) cannot be shared or modified for cross-account operations, making a Customer Managed Key necessary.

Anahtar Kavram

Cross-account centralized resource policies and KMS CMK sharing boundaries under AWS Organizations.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Multi-Account Governance and Organizational Structure

Bu konudan daha fazla soru