A multinational financial services company uses AWS Organizations with 400 member accounts. The security team is designing a centralized monitoring and auditing solution. They require all regional AWS CloudTrail logs to be aggregated into a single Amazon S3 bucket within a dedicated Log Archive account. The logs must be encrypted at rest using a customer managed KMS key. The configuration must enforce least privilege, prevent unauthorized modification of trails within member accounts, and ensure uninterrupted log delivery. Which combination of S3 bucket policy, KMS key configuration, and Service Control Policy (SCP) satisfies these requirements while preventing log delivery failures?
- ADeploy an AWS Organizations organization trail in the management account that logs to a central Amazon S3 bucket in the Log Archive account. Configure default bucket encryption using the AWS-managed KMS key for Amazon S3 (aws/s3). Update the S3 bucket policy to grant s3:PutObject permissions to the cloudtrail.amazonaws.com service principal with a condition on aws:PrincipalOrgID. Apply a Service Control Policy (SCP) at the organization root that denies cloudtrail:StopLogging, cloudtrail:UpdateTrail, and cloudtrail:DeleteTrail actions.
- BDeploy an AWS Organizations organization trail in the management account that logs to a central Amazon S3 bucket in the Log Archive account. In the Log Archive account, configure a customer managed KMS key. Attach a Service Control Policy (SCP) to the organization root that explicitly allows s3:PutObject to the central S3 bucket and kms:GenerateDataKey* to the central KMS key for all member accounts, and denies cloudtrail:StopLogging, cloudtrail:UpdateTrail, and cloudtrail:DeleteTrail actions.
- Deploy an AWS Organizations organization trail in the management account that logs to a central Amazon S3 bucket in the Log Archive account. In the Log Archive account, configure a customer managed KMS key with a key policy that allows the cloudtrail.amazonaws.com service principal to execute kms:GenerateDataKey* and kms:DescribeKey with a condition restricting the source ARN to the trail. Update the S3 bucket policy to grant s3:PutObject permissions to the cloudtrail.amazonaws.com service principal with a condition on aws:PrincipalOrgID. Apply a Service Control Policy (SCP) at the organization root that denies cloudtrail:StopLogging, cloudtrail:UpdateTrail, and cloudtrail:DeleteTrail actions.Cevap
- DDeploy an AWS Organizations organization trail in the management account that logs to a central Amazon S3 bucket in the Log Archive account. In the Log Archive account, configure a customer managed KMS key and update its key policy to allow the cloudtrail.amazonaws.com service principal to execute kms:GenerateDataKey* and kms:DescribeKey. Configure the S3 bucket policy to grant read and write access to the IAM roles within the management account only, assuming the organization trail writes logs using the management account's credentials. Apply a Service Control Policy (SCP) at the organization root that denies cloudtrail:StopLogging, cloudtrail:UpdateTrail, and cloudtrail:DeleteTrail actions.
Cevap
The correct solution deploys an organization trail in the management account delivering logs to a central S3 bucket in the Log Archive account. The Log Archive account uses a customer managed KMS key with key policies permitting the CloudTrail service principal to generate data keys and describe the key, scoped to the trail's ARN. The S3 bucket policy permits the CloudTrail service principal to write objects scoped by the organization ID. Lastly, a Service Control Policy restricts member accounts from modifying or stopping CloudTrail logging.
The correct solution properly aligns cross-account S3 bucket policies and customer managed KMS key policies to trust the CloudTrail service principal (cloudtrail.amazonaws.com) using the organization's ID and trail ARN as conditions. It also leverages an SCP as a preventive guardrail to enforce logging integrity without misinterpreting it as an access-granting policy.
Adım Adım Çözüm
Anahtar Kavram
Centralized cross-account logging requires resource-based policy alignment (S3 bucket policy and KMS key policy) allowing the service principal, while SCPs enforce logging compliance at the organization boundary.
Tahmini Süre:3m 0s