A manufacturing corporation uses AWS Organizations to manage member accounts. The security team is designing a centralized logging and auditing solution. They want to collect AWS CloudTrail logs from all accounts and regions into a single Amazon S3 bucket located in a dedicated Security account. The solution must ensure that all log data is encrypted at rest using an AWS KMS key managed by the security team, member accounts cannot disable logging, and log delivery follows the principle of least privilege. Which combination of actions should the Solutions Architect perform to meet these requirements? (Select TWO.)
- Create an organization trail in the AWS Organizations management account that delivers logs to the central S3 bucket in the Security account, and apply an S3 bucket policy that allows write operations from the CloudTrail service principal under the condition that the organization ID matches the management account's organization.Cevap
- BEnable encryption on the organization trail using the default AWS-managed KMS key for CloudTrail in the Security account to automatically secure all logs sent from member accounts.
- Create a customer managed KMS key in the Security account, configure the key policy to allow the CloudTrail service principal to generate data keys and decrypt logs across the organization, and associate this key with the organization trail.Cevap
- DConfigure the central S3 bucket policy to grant write access directly to the root IAM user of each member account individually to verify identity before log delivery.
- EAttach a Service Control Policy (SCP) to the organization's Root OU that grants write permissions to the central S3 bucket for all member accounts to allow their local CloudTrail configurations to deliver logs.
Cevap
Create an organization trail in the AWS Organizations management account that delivers logs to the central S3 bucket in the Security account, apply a bucket policy allowing the CloudTrail service principal restricted by the organization ID, and create a customer managed KMS key in the Security account with a key policy allowing cross-account CloudTrail access.
The correct solution uses an organization trail to consolidate log files from all AWS accounts within the Organization. The S3 bucket policy must allow the CloudTrail service principal to write logs, restricted by the organization ID to secure access. Because AWS-managed KMS keys cannot be shared across accounts, a customer managed key must be created in the Security account with a policy allowing the CloudTrail service principal to perform encryption operations.
Adım Adım Çözüm
Anahtar Kavram
Centralized auditing requires an organization-wide trail, a service-principal-aware S3 bucket policy restricted by organization ID, and a customer managed KMS key to handle cross-account encryption permissions.