Examkin

Soru

Zorluk: KolayCentralized Monitoring, Logging, and Auditing Solutions

A solutions architect is designing a centralized logging solution for an AWS Organization with multiple member accounts. The security team requires all AWS CloudTrail logs to be consolidated into a single Amazon S3 bucket located in a dedicated Security account. The architecture must support encryption at rest for the log files. Which configuration meets these requirements?

  1. A
    Create a trail in each member account and configure them to send logs to the centralized S3 bucket. Apply a Service Control Policy (SCP) at the Organization root level that grants the member accounts write access to the S3 bucket in the Security account.
  2. B
    Create an Organization trail in the management account that delivers logs to the S3 bucket in the Security account. Configure the S3 bucket policy to allow the CloudTrail service principal to write logs. Encrypt the log files using the AWS-managed KMS key for CloudTrail (aws/cloudtrail).
  3. Create an Organization trail in the management account that delivers logs to the S3 bucket in the Security account. Configure the S3 bucket policy to allow the CloudTrail service principal to write logs. Encrypt the log files using a customer managed AWS KMS key with a key policy that allows cross-account access.Cevap
  4. D
    Create an Organization trail in the management account that delivers logs to the S3 bucket in the Security account. Configure local IAM policies in each member account to grant permission to write to the centralized S3 bucket, without modifying the S3 bucket policy in the Security account.

Cevap

Create an Organization trail in the management account that delivers logs to the S3 bucket in the Security account. Configure the S3 bucket policy to allow the CloudTrail service principal to write logs. Encrypt the log files using a customer managed AWS KMS key with a key policy that allows cross-account access.
Creating an AWS Organizations trail simplifies log collection by automatically applying the trail to all member accounts. Because the logs are stored in a centralized S3 bucket within a different AWS account (the Security account), the S3 bucket policy must explicitly allow the CloudTrail service principal to write objects. Additionally, since the logs are delivered from multiple AWS accounts, the KMS key used for encryption must be a customer managed key with a policy that allows cross-account KMS actions, as AWS-managed KMS keys cannot be shared or modified for cross-account access.

Adım Adım Çözüm

1
Establish the multi-account logging trail.
Use AWS Organizations to create an Organization trail in the management account, which automatically applies the trail to all member accounts.
This reduces operational overhead and ensures compliance across all accounts.
2
Configure the destination S3 bucket permissions.
Add a bucket policy to the centralized S3 bucket in the Security account allowing the CloudTrail service principal (cloudtrail.amazonaws.com) to perform s3:PutObject actions.
Cross-account access to S3 requires the resource-based policy of the target bucket to explicitly trust the calling service/accounts.
3
Configure KMS key encryption for log files.
Create a customer managed key (CMK) in the Security account, and update its key policy to allow CloudTrail and the member accounts to use the key for encryption. Avoid using AWS-managed keys.
AWS-managed KMS keys (like aws/cloudtrail) do not support cross-account key sharing or key policy modifications, which causes log delivery from member accounts to fail.

Anahtar Kavram

Centralized multi-account logging using AWS Organizations CloudTrail, S3 bucket policies for cross-account access, and customer managed KMS keys for cross-account encryption.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Centralized Monitoring, Logging, and Auditing Solutions

Bu konudan daha fazla soru