A financial company is enhancing data protection and compliance by centralizing its application logs from multiple member accounts within an AWS Organization. The solution must store these logs in an Amazon S3 bucket within a centralized Security Audit account. The logs must be encrypted at rest using a KMS key, and member account administrators must be restricted from disabling or deleting the encryption keys. Which combination of actions should the solutions architect recommend to meet these requirements?
- AConfigure the S3 bucket in the Security Audit account to use the default AWS managed KMS key (aws/s3) for encryption. Configure the S3 bucket policy in the Security Audit account to allow member accounts to write logs. Apply a Service Control Policy (SCP) at the Organization root that denies kms:DisableKey and kms:ScheduleKeyDeletion actions.
- Create a customer managed KMS key in the Security Audit account, and enable automatic key rotation. Configure the KMS key policy to permit the member accounts to use the key for encryption. Configure the S3 bucket policy in the Security Audit account to allow the member accounts to upload objects, specifying the AWS Organization ID as a condition. Configure the member accounts to write their logs to this S3 bucket using the customer managed KMS key. Apply a Service Control Policy (SCP) at the Organization root to deny kms:DisableKey and kms:ScheduleKeyDeletion actions.Cevap
- CCreate a customer managed KMS key in the Security Audit account, and enable automatic key rotation. Create a Service Control Policy (SCP) at the Organization root that explicitly grants kms:Encrypt and kms:GenerateDataKey permissions to the member accounts for the customer managed KMS key, while denying kms:DisableKey and kms:ScheduleKeyDeletion. Configure the member accounts to write their logs to the Security Audit account's S3 bucket.
- DCreate a customer managed KMS key in the Security Audit account, and enable automatic key rotation. Configure the KMS key policy to permit the member accounts to use the key for encryption. Configure the member accounts to write their logs to the Security Audit account's S3 bucket using this KMS key. Do not configure an S3 bucket policy in the Security Audit account, relying on the KMS key policy permissions and AWS Organizations membership to implicitly allow log delivery. Apply a Service Control Policy (SCP) at the Organization root to deny kms:DisableKey and kms:ScheduleKeyDeletion actions.
Cevap
Create a customer managed KMS key in the Security Audit account, enable automatic key rotation, and configure the KMS key policy and S3 bucket policy to allow cross-account access. Then, apply a Service Control Policy (SCP) to deny disabling or deleting keys.
To support cross-account access, a customer managed KMS key must be used because AWS managed keys cannot have their key policies modified. The Security Audit account's S3 bucket policy must explicitly permit the member accounts to upload objects (using condition keys like aws:PrincipalOrgID for organization-wide scope). In addition, key policies must explicitly grant the member accounts permissions to use the KMS key. To enforce key protection, a Service Control Policy (SCP) must be used to deny deletion and disabling actions, preventing member account administrators from tampering with the key.
Adım Adım Çözüm
Anahtar Kavram
Cross-account KMS encryption, S3 bucket policies, and Service Control Policies (SCPs) acting as guardrails.
Tahmini Süre:2m 30s