Examkin

Soru

Zorluk: Çok zorMulti-Account Governance and Organizational Structure

An enterprise is designing a multi-account compliance structure within AWS Organizations consisting of 250 member accounts. The security team requires all member accounts to deliver AWS CloudTrail logs to a centralized Amazon S3 bucket in a dedicated Security account. The S3 bucket must be encrypted using an AWS KMS Customer Managed Key (CMK) managed by the security team. Furthermore, member accounts must be blocked from deleting the centralized logging resources or disabling CloudTrail. Which implementation strategy meets these requirements with the minimum operational overhead while adhering to the principle of least privilege?

  1. Attach an SCP at the Organization root that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, and s3:DeleteBucket. In the Security account, configure the centralized S3 bucket policy to allow s3:PutObject from cloudtrail.amazonaws.com with a condition for aws:PrincipalOrgID. Configure the KMS CMK key policy in the Security account to allow cloudtrail.amazonaws.com to perform kms:GenerateDataKey* and kms:DescribeKey operations with a condition checking that aws:SourceArn matches the organization's trails.Cevap
  2. B
    Attach an SCP at the Organization root that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, and s3:DeleteBucket. Encrypt the centralized S3 bucket using the default AWS-managed KMS key (aws/s3) in the Security account. Modify the S3 bucket policy to allow s3:PutObject for the CloudTrail service principal across the organization using the aws:PrincipalOrgID condition.
  3. C
    Attach an SCP at the Organization root that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, and s3:DeleteBucket, and explicitly allows s3:PutObject and kms:GenerateDataKey* for the CloudTrail service principal. Do not configure any S3 bucket policy or KMS key policy in the Security account, as the SCP will automatically delegate these permissions down to all member accounts and services.
  4. D
    Attach an SCP at the Organization root that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, and s3:DeleteBucket. In the Security account, configure the centralized S3 bucket policy to allow s3:PutObject from cloudtrail.amazonaws.com with a condition for aws:PrincipalOrgID. Create a Customer Managed Key (CMK) in the Security account, but leave the default key policy intact, as CloudTrail will automatically assume the local service role to perform encryption when delivering logs.

Cevap

The correct strategy is to attach an SCP at the Organization root to deny disabling CloudTrail and deleting S3 resources. In the Security account, configure the S3 bucket policy to allow s3:PutObject from cloudtrail.amazonaws.com with an aws:PrincipalOrgID condition, and configure the Customer Managed Key policy to permit cloudtrail.amazonaws.com to perform kms:GenerateDataKey* and kms:DescribeKey operations restricted by the aws:SourceArn of the organization's trails.
The correct strategy combines SCPs, S3 bucket policies, and KMS CMK key policies to satisfy all requirements securely. The SCP enforces the guardrails at the Organization level, preventing any member account administrator from stopping the trail or deleting the logging resources. Since CloudTrail needs to write to a centralized bucket in a different account, the S3 bucket policy must allow `s3:PutObject` from the `cloudtrail.amazonaws.com` principal, limited to the organization by `aws:PrincipalOrgID`. Furthermore, because the bucket is encrypted with KMS, and default AWS-managed keys cannot be shared across accounts, a Customer Managed Key (CMK) must be used. Its key policy must explicitly allow the `cloudtrail.amazonaws.com` service principal to use `kms:GenerateDataKey*` and `kms:DescribeKey` to encrypt the logs before delivery.

Adım Adım Çözüm

1
Enforce deletion and configuration guardrails at the Organization level.
Attach an SCP to the root of AWS Organizations to deny cloudtrail:StopLogging, cloudtrail:DeleteTrail, and s3:DeleteBucket.
This guarantees that no user or administrator in any member account can disable logging or delete the centralized S3 bucket resources.
2
Configure the centralized S3 bucket policy in the Security account to allow cross-account delivery.
Add an S3 bucket policy that allows s3:PutObject with the principal set to cloudtrail.amazonaws.com and a condition evaluating aws:PrincipalOrgID.
This allows the CloudTrail service writing on behalf of any account in the organization to deliver logs to the central bucket while blocking external accounts.
3
Set up a Customer Managed Key (CMK) for bucket encryption.
Create a symmetric Customer Managed Key in the Security account instead of using the AWS-managed aws/s3 key.
AWS-managed keys cannot be shared cross-account, meaning CloudTrail in member accounts would not be able to encrypt logs during delivery.
4
Configure the CMK key policy to authorize CloudTrail.
Grant the cloudtrail.amazonaws.com principal permissions to perform kms:GenerateDataKey* and kms:DescribeKey, restricted by the aws:SourceArn condition.
This allows CloudTrail to encrypt logs using the CMK before writing them to the S3 bucket, preventing access denial failures.

Anahtar Kavram

Cross-account centralized CloudTrail logging requires a combination of organizational SCP guardrails, resource-level S3 bucket policies, and Customer Managed Keys (CMKs) with explicit service principal delegations.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Multi-Account Governance and Organizational Structure

Bu konudan daha fazla soru