An enterprise uses AWS Organizations to manage multiple member accounts. A solutions architect is designing a centralized auditing solution using AWS Config. The configuration history and configuration snapshots from all member accounts must be delivered to a single Amazon S3 bucket located in a dedicated Security account. The S3 bucket must be encrypted using an AWS KMS key. The solution must ensure that member account administrators cannot disable AWS Config recorders or delivery channels. The S3 bucket policy and KMS key policy must follow the principle of least privilege. Which two actions should the solutions architect perform to meet these requirements?
- In the Security account, configure the S3 bucket policy to allow the AWS Config service principal (config.amazonaws.com) to perform s3:PutObject and s3:GetBucketAcl actions, restricted by the AWS Organization ID using the aws:PrincipalOrgID condition. Configure the KMS customer managed key (CMK) policy to allow the AWS Config service principal to perform kms:GenerateDataKey and kms:Decrypt actions, restricted by the same organization condition.Cevap
- In the organization's management account, create a Service Control Policy (SCP) that denies config:DeleteConfigurationRecorder, config:DeleteDeliveryChannel, config:StopConfigurationRecorder, and config:PutConfigurationRecorder actions unless the caller is a specific administrative IAM role, and attach this SCP to the organization's root or member organizational units (OUs).Cevap
- CEnable default S3 encryption on the bucket in the Security account using the AWS managed KMS key (aws/s3), and configure the KMS key policy to grant the AWS Config service principal cross-account access for all member accounts in the organization.
- DIn the organization's management account, create a Service Control Policy (SCP) with an Allow effect that explicitly grants config:PutConfigurationRecorder, config:StartConfigurationRecorder, and s3:PutObject permissions to the member accounts to ensure the local recorders can deliver logs to the central S3 bucket.
- EIn the Security account, configure the S3 bucket policy to allow the root account principal of each member account (arn:aws:iam::[AccountID]:root) to perform s3:PutObject and s3:GetBucketAcl actions, and rely on IAM policies within the member accounts to authorize the AWS Config service to write to the central bucket.
Cevap
To meet the requirements, the solutions architect must configure the S3 bucket policy and KMS CMK key policy in the Security account to permit the AWS Config service principal (config.amazonaws.com) to write objects and generate data keys, while restricting access to the AWS Organization. Additionally, a Service Control Policy (SCP) should be applied to prevent administrators in member accounts from deleting or disabling the AWS Config recorders and delivery channels.
The correct solution combines a resource-based policy configuration in the centralized Security account with organizational control policies in the management account. First, AWS Config requires S3 permissions (s3:PutObject and s3:GetBucketAcl) and KMS permissions (kms:GenerateDataKey and kms:Decrypt) granted directly to its service principal (config.amazonaws.com) in the target resource policies. Restricting this access using the aws:PrincipalOrgID condition key ensures only accounts within the organization can use these resources. Second, a Service Control Policy (SCP) is the correct mechanism to enforce governance across member accounts by denying the ability to delete or stop the configuration recorder and delivery channel, overriding local administrator permissions.
Adım Adım Çözüm
Anahtar Kavram
Centralized Config Logging with Cross-Account KMS CMK and SCP Guardrails
Tahmini Süre:2m 0s