An online education platform leverages AWS Organizations to manage member accounts. To meet strict regulatory standards, the platform's security team needs to implement centralized auditing by consolidating AWS CloudTrail logs from all member accounts into a secure, dedicated Amazon S3 bucket within a centralized Security account. The logs must be encrypted at rest using a key managed by the platform's security team. The setup must ensure that individual member accounts can deliver logs to the central bucket but cannot access or decrypt logs from other accounts. Which configuration strategy should the solutions architect recommend to satisfy these requirements?
- Configure an Organization Trail in the management account that delivers logs to an Amazon S3 bucket in the Security account. Create a customer managed KMS key in the Security account, and update its key policy to allow the AWS CloudTrail service principal to perform 'kms:GenerateDataKey*' and 'kms:DescribeKey' operations with a condition restricting access to the organization's ID. Configure the S3 bucket policy in the Security account to grant 's3:PutObject' permissions to the CloudTrail service principal with a condition for the organization's ID.Cevap
- BConfigure an Organization Trail in the management account that delivers logs to an Amazon S3 bucket in the Security account. Enable encryption on the target S3 bucket using the default AWS managed KMS key (aws/s3) in the Security account to avoid the overhead of custom key policy maintenance, as AWS managed keys automatically permit cross-account log delivery by CloudTrail.
- CConfigure an Organization Trail in the management account that delivers logs to an Amazon S3 bucket in the Security account. Instead of modifying the S3 bucket policy in the Security account, configure local IAM roles in each member account with write permissions to the central S3 bucket, and configure CloudTrail to assume these roles in each respective account to perform log delivery.
- DConfigure an Organization Trail in the management account that delivers logs to an Amazon S3 bucket in the Security account. Attach a Service Control Policy (SCP) to the organization's root that explicitly grants 's3:PutObject' permissions on the Security account's S3 bucket to all member accounts, eliminating the need to modify the S3 bucket policy in the Security account.
Cevap
Configure an Organization Trail in the management account that delivers logs to an Amazon S3 bucket in the Security account, utilizing a customer managed KMS key in the Security account with a key policy allowing the CloudTrail service principal, and configuring S3 bucket policy permissions for the CloudTrail service principal.
An Organization Trail consolidates log delivery across the AWS Organization. For security-account S3 buckets, the bucket policy must grant 's3:PutObject' permissions to the CloudTrail service principal. When encrypting using KMS, a customer managed key is required because AWS managed KMS keys cannot be shared across accounts or have their key policies edited to allow cross-account write access from CloudTrail.
Adım Adım Çözüm
Anahtar Kavram
Cross-account AWS CloudTrail logging requires a combination of S3 bucket policies and custom KMS key policies that permit the CloudTrail service principal to write and encrypt logs from all member accounts.