Examkin

Soru

Zorluk: ZorMulti-Account Governance and Organizational Structure

An enterprise is establishing a new multi-account governance strategy using AWS Organizations. The security team requires that all API activity across all accounts is centrally logged to a secure Amazon S3 bucket in a dedicated Log Archive account, encrypted with a customer-managed KMS key, and protected against deletion or modification by any account administrator. What is the correct sequence of steps to configure this centralized logging and governance structure?

  1. 1Create the AWS Organization from the management account and construct an Organizational Unit (OU) structure containing a Security OU and a Workloads OU.
  2. 2Provision a dedicated Log Archive account under the Security OU to isolate and host centralized audit and compliance data.
  3. 3In the Log Archive account, create the destination S3 bucket with a policy allowing write access from the organization, and create a customer-managed KMS key with a policy allowing CloudTrail encryption.
  4. 4Enable trusted access for AWS CloudTrail in the AWS Organizations management account, and create an organization trail configured to send logs to the Log Archive S3 bucket and encrypt them using the customer-managed KMS key.
  5. 5Attach a Service Control Policy (SCP) to the organization's Root or OUs to prevent member accounts from modifying the organization trail, KMS key, or S3 bucket.

Cevap

To establish centralized and protected logging, first create the AWS Organization and OUs. Second, provision the dedicated Log Archive account under the Security OU. Third, set up the secure S3 bucket and KMS key within the Log Archive account. Fourth, enable trusted access for CloudTrail and deploy the organization trail. Finally, enforce security by attaching an SCP at the organization Root or OU level to prevent modification of these logging resources.
The correct order establishes a logical progression of dependencies: defining the organizational structure first, provisioning the dedicated account, setting up the destination S3 bucket and KMS keys inside that account, deploying the organization-wide CloudTrail to stream data to that bucket, and finally securing the setup using Service Control Policies (SCPs) to prevent tampering.

Adım Adım Çözüm

1
Create the AWS Organization and define the OU hierarchy.
An AWS Organization is initialized with management control, and logical OUs (such as Security and Workloads) are available for grouping accounts.
You cannot deploy accounts or apply policies structurally without first establishing the Organization and its OUs.
2
Provision the Log Archive account under the Security OU.
A clean, isolated member account is created specifically for storing logs and audit records.
The destination account must exist in the organization before configuring localized destination resources.
3
Configure the S3 bucket and customer-managed KMS key inside the Log Archive account.
An S3 bucket is configured with bucket policies allowing the CloudTrail service to write logs, and a KMS key is configured to allow encryption of those logs.
The trail deployment in the next step will fail if the specified target S3 bucket or KMS key does not exist or lacks correct permission policies.
4
Enable trusted access for AWS CloudTrail in the Organizations management account and deploy the organization trail.
A single organization-wide trail automatically starts delivering encrypted API activity logs from all member accounts to the centralized S3 bucket.
This establishes the logging mechanism across the entire Organization.
5
Attach an SCP to the Root of the organization to prevent modification of the logging resources.
Root and administrator users in all member accounts are blocked from disabling the trail, deleting the S3 bucket, or modifying the KMS key policies.
Applying the SCP secures the logging configuration against tampering, fulfilling the compliance and governance requirements.

Anahtar Kavram

Establishing multi-account governance involves a precise sequence of setting up the AWS Organization structure, isolating resources in dedicated accounts (such as a Log Archive account), configuring destination storage and encryption keys, deploying organization-wide services via trusted access, and securing the configuration using Service Control Policies (SCPs).
Bu soruyu puanla

Konular

Multi-Account Governance and Organizational Structure

Bu konudan daha fazla soru