Examkin

Soru

Zorluk: KolayCentralized Monitoring, Logging, and Auditing Solutions

A company is using AWS Organizations to manage multiple AWS accounts. The security team wants to centralize auditing by collecting AWS CloudTrail logs from all member accounts into a single Amazon S3 bucket located in a dedicated Security account. The logs must be encrypted at rest, and the configuration must minimize management overhead.

Which of the following steps are required to implement this solution? (Select TWO.)

  1. Create the trail in the organization management account and configure it as an organization trail.Cevap
  2. Configure the Amazon S3 bucket policy in the Security account to grant write permissions to the CloudTrail service principal.Cevap
  3. C
    Create a local IAM role in each member account that allows the CloudTrail service to assume it and write to the Security account S3 bucket.
  4. D
    Encrypt the S3 bucket using the default AWS-managed KMS key (aws/s3) and grant cross-account permissions on this key to the member accounts.
  5. E
    Attach a Service Control Policy (SCP) to the organization root that explicitly grants permission for member accounts to write to the central S3 bucket.

Cevap

Create the trail in the organization management account as an organization trail, and configure the S3 bucket policy in the Security account to grant write permissions to the CloudTrail service principal.
To centralize CloudTrail logs from multiple accounts in an AWS Organization, an organization trail should be created in the management account. This automatically deploys the trail across all member accounts. The centralized S3 bucket must have a bucket policy that grants write permissions (s3:PutObject) to the CloudTrail service principal (cloudtrail.amazonaws.com) to allow cross-account delivery.

Adım Adım Çözüm

1
Enable centralized trail creation.
By creating an organization trail in the management account, CloudTrail logs events from all current and future member accounts automatically without configuring trails manually in each account.
This minimizes operational overhead and ensures comprehensive coverage across the AWS Organization.
2
Configure destination bucket access.
The S3 bucket policy in the Security account is updated to allow the 'cloudtrail.amazonaws.com' principal to perform 's3:PutObject' actions, restricted by the organization ID condition.
CloudTrail requires explicit permission to write logs to a cross-account S3 bucket, which is managed via S3 bucket policies.

Anahtar Kavram

Centralized CloudTrail Logging in AWS Organizations
Bu soruyu puanla

Konular

Centralized Monitoring, Logging, and Auditing Solutions

Bu konudan daha fazla soru