Examkin

Soru

Zorluk: OrtaSecurity and Compliance Control Design

A company is designing a centralized compliance logging solution on AWS. The architecture consists of multiple member accounts within an AWS Organization and a dedicated Security account. The security team wants to configure AWS CloudTrail in each member account to deliver log files to a single Amazon S3 bucket in the Security account. All log files must be encrypted at rest using a Key Management Service (KMS) key. Which combination of actions is required to configure the encryption and access controls? (Select TWO.)

  1. In the Security account, create a customer managed KMS key and configure its key policy to allow the AWS CloudTrail service principal to perform kms:GenerateDataKey* and kms:DescribeKey operations.Cevap
  2. Attach an S3 bucket policy to the destination bucket in the Security account that grants s3:PutObject permissions to the AWS CloudTrail service principal, with conditions restricting access to the organization's trail ARNs.Cevap
  3. C
    Configure the destination S3 bucket to use the default AWS-managed key (aws/s3) for server-side encryption, and modify its policy to delegate encryption permissions to the CloudTrail service principal across all member accounts.
  4. D
    Attach a Service Control Policy (SCP) to the member accounts' Organizational Units (OUs) that explicitly grants the s3:PutObject and kms:GenerateDataKey permissions to all member accounts to permit log writing to the Security account.
  5. E
    Configure the S3 bucket policy in the Security account to grant s3:PutObject permissions to the member accounts' root users, relying on each member account's IAM policies to delegate the permission to CloudTrail.

Cevap

To configure secure, cross-account log aggregation with encryption, you must create a customer managed KMS key in the Security account with a key policy allowing the CloudTrail service principal to generate data keys, and apply an S3 bucket policy on the destination bucket in the Security account allowing the CloudTrail service principal to write objects under conditions restricted to the organization's trail ARNs.
The correct configuration requires using a customer managed KMS key because AWS-managed keys cannot be shared cross-account. The KMS key policy must authorize the AWS CloudTrail service principal to generate data keys. Additionally, the S3 bucket policy in the Security account must explicitly trust the CloudTrail service principal to upload log files, using organizational trail conditions to prevent unauthorized write attempts.

Adım Adım Çözüm

1
Determine the type of KMS key needed for cross-account service encryption.
A customer managed KMS key must be selected because AWS-managed keys cannot be shared cross-account or have their key policies modified.
CloudTrail in member accounts needs to encrypt logs using a key owned by the Security account, which requires custom policy statements.
2
Configure the KMS key policy to permit CloudTrail operations.
Add permissions for the service principal 'cloudtrail.amazonaws.com' to perform 'kms:GenerateDataKey*' and 'kms:DescribeKey'.
This allows CloudTrail to request data keys to encrypt the logs before writing them to S3.
3
Configure S3 bucket access for cross-account logging.
Attach a bucket policy to the Security account's destination S3 bucket allowing 's3:PutObject' for the CloudTrail service principal, scoped to the organization's trail ARNs using condition keys.
This establishes the necessary trust relationship allowing CloudTrail to deliver logs securely to the centralized bucket.

Anahtar Kavram

Cross-account resource access and encryption using Customer Managed KMS Keys and S3 Bucket Policies for centralized AWS services.
Bu soruyu puanla

Konular

Security and Compliance Control Design

Bu konudan daha fazla soru