A large enterprise is setting up centralized logging for its AWS Organization, which contains member accounts. The solutions architect is configuring an organization-wide AWS CloudTrail trail to deliver management events to a centralized Amazon S3 bucket located in a dedicated Security account. The security policy requires that all logs be encrypted at rest using AWS KMS with a Customer Managed Key (CMK) to allow detailed auditing of key access. Which of the following configurations must the solutions architect implement to ensure successful log delivery from all accounts?
- AAttach a Service Control Policy (SCP) at the Organization root that explicitly allows the CloudTrail service principal to write to the central S3 bucket, removing the requirement to configure a resource-based S3 bucket policy in the Security account.
- Configure the S3 bucket policy in the Security account to grant write permissions to the AWS CloudTrail service principal, restricting access using the Organization ID condition. Update the Customer Managed KMS key policy to grant the CloudTrail service principal permissions to generate data keys and decrypt, restricted by the Organization ID.Cevap
- CEnable default encryption on the central S3 bucket using the AWS-managed KMS key (aws/s3) and configure the S3 bucket policy to allow the CloudTrail service principal to write objects from any account within the Organization.
- DConfigure the S3 bucket policy in the Security account to grant write permissions to individual member account IAM roles, and configure the organization-wide trail to assume these roles when delivering log files.
Cevap
Configure the S3 bucket policy to grant write permissions to the CloudTrail service principal with the Organization ID condition, and configure the Customer Managed KMS key policy to allow CloudTrail to generate data keys and decrypt.
The correct configuration requires granting write access (s3:PutObject) to the AWS CloudTrail service principal (cloudtrail.amazonaws.com) via the S3 bucket policy in the Security account, using the aws:PrincipalOrgID condition to ensure only trails within the organization can write. Additionally, because a Customer Managed KMS Key is used, the key policy must grant permissions (kms:GenerateDataKey* and kms:Decrypt) to the CloudTrail service principal, as AWS-managed keys do not support policy modification and cannot be shared across accounts.
Adım Adım Çözüm
Anahtar Kavram
Cross-account centralized logging with AWS CloudTrail, S3 bucket policies, and Customer Managed KMS Keys.
Tahmini Süre:1m 30s