A solutions architect is configuring a centralized logging solution to aggregate AWS CloudTrail logs from all member accounts within an AWS Organization. The logs will be deposited into a single Amazon S3 bucket situated in a dedicated Security account. The architect needs to ensure that CloudTrail in the member accounts can successfully deliver logs to the bucket and that the log files are encrypted at rest using KMS. Which TWO configurations are required to meet these requirements?
- Configure the S3 bucket policy in the Security account to grant s3:PutObject permissions to the CloudTrail service principal, specifying the aws:PrincipalOrgID condition key.Cevap
- Create a customer managed KMS key in the Security account with a key policy that grants the CloudTrail service principal permissions to perform kms:GenerateDataKey* operations.Cevap
- CEnable encryption on the S3 bucket using the AWS-managed KMS key for S3 (aws/s3) and grant cross-account write permissions to the member accounts using IAM policies.
- DApply a Service Control Policy (SCP) at the organization root that grants the s3:PutObject permission on the destination S3 bucket to the CloudTrail service principal.
- EConfigure the S3 bucket policy to only permit local IAM roles in the Security account to write objects, and configure member accounts to assume these roles during log delivery.
Cevap
The configurations required are: first, setting up the S3 bucket policy in the Security account to grant s3:PutObject permissions to the CloudTrail service principal using the aws:PrincipalOrgID condition; second, creating a customer managed KMS key in the Security account and configuring its policy to allow the CloudTrail service principal to generate data keys.
The correct configurations involve allowing the CloudTrail service principal to write to the destination S3 bucket via its bucket policy, using the aws:PrincipalOrgID condition to securely filter access to the organization. Additionally, since the logs are encrypted at rest using KMS and come from multiple member accounts, a customer managed key is required because its policy must be updated to allow CloudTrail to generate data keys for encryption.
Adım Adım Çözüm
Anahtar Kavram
Centralized cross-account logging requires resource policies (S3 bucket policy and KMS key policy) that explicitly trust the CloudTrail service principal and restrict access using organizational context (e.g., aws:PrincipalOrgID).