Examkin

Soru

Zorluk: KolaySecurity and Compliance Control Design

A solutions architect is configuring AWS CloudTrail in a member account to deliver log files to a centralized Amazon S3 bucket in a dedicated security account. The log delivery is currently failing. Which configuration must be applied to the S3 bucket in the security account to allow CloudTrail to write the logs?

  1. Configure the S3 bucket policy in the security account to allow the CloudTrail service principal (cloudtrail.amazonaws.com) to perform the s3:PutObject action.Cevap
  2. B
    Configure the S3 bucket policy in the security account to grant access to the member account's root user principal, relying on the member account to delegate permissions to CloudTrail.
  3. C
    Attach a Service Control Policy (SCP) to the Organizational Unit (OU) of the member account that grants the s3:PutObject action on the centralized S3 bucket.
  4. D
    Configure default encryption on the centralized S3 bucket using the AWS managed key (aws/s3) and grant CloudTrail permissions to use this key.

Cevap

Configure the S3 bucket policy in the security account to allow the CloudTrail service principal (cloudtrail.amazonaws.com) to perform the s3:PutObject action.
The correct configuration requires modifying the S3 bucket policy in the security account to grant the s3:PutObject permission directly to the CloudTrail service principal (cloudtrail.amazonaws.com). Since CloudTrail writes logs as an AWS service principal, a direct resource-based policy trust must be established on the destination bucket.

Adım Adım Çözüm

1
Identify the writer principal.
The writer is the AWS CloudTrail service principal (cloudtrail.amazonaws.com), not an IAM user or role within the member account.
AWS services delivering logs act as service principals and must be granted permissions directly by the resource owner.
2
Configure the resource-based policy.
Apply an S3 bucket policy to the centralized bucket in the security account.
Cross-account resource access requires a resource-based policy (the S3 bucket policy) to authorize access from external principals.
3
Specify the action and conditions.
Grant s3:PutObject to cloudtrail.amazonaws.com, optionally adding conditions to restrict writes to specific organization IDs or ARNs.
This ensures only authorized CloudTrail trails can write to the centralized bucket, preventing unauthorized write attempts.

Anahtar Kavram

Cross-account resource sharing and service principal access delegation in AWS.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Security and Compliance Control Design

Bu konudan daha fazla soru