Examkin

Soru

Zorluk: ZorCentralized Monitoring, Logging, and Auditing Solutions

A healthcare provider manages 110110 AWS accounts under a single organization in AWS Organizations. The lead security architect is designing a centralized auditing solution to track resource configuration changes. AWS Config must be enabled in all member accounts, with configuration history and snapshots consolidated into a central Amazon S3 bucket in a dedicated Security account. The solution must meet the following requirements:
- All configuration logs must be encrypted at rest using a customer managed key (KMS CMK) controlled by the security team.
- The central S3 bucket must enforce a write-once-read-many (WORM) policy to prevent log deletion or modification, even by administrative users in the Security account.
- Individual member accounts must be prevented from disabling the AWS Config recording or altering the delivery channel configuration.

Which combination of actions will meet these requirements?

  1. In the Security account, create the S3 bucket with S3 Object Lock enabled in Compliance mode. Configure a bucket policy that grants the s3:PutObject and s3:GetBucketAcl permissions to the AWS Config service principal (config.amazonaws.com) and restricts access using the aws:PrincipalOrgID condition. In the Security account, create a KMS customer managed key (CMK) and configure its key policy to allow kms:GenerateDataKey* and kms:Decrypt for the AWS Config service principal (config.amazonaws.com) with the aws:PrincipalOrgID condition. Set the bucket default encryption to use this KMS CMK. In the management account, attach a Service Control Policy (SCP) to the organization root that denies config:StopConfigurationRecorder, config:DeleteDeliveryChannel, and config:PutDeliveryChannel actions.Cevap
  2. B
    In the Security account, create the S3 bucket with S3 Object Lock enabled in Compliance mode. Configure the bucket default encryption to use the AWS-managed KMS key for Amazon S3 (aws/s3). Apply a bucket policy that grants the s3:PutObject and s3:GetBucketAcl permissions to the AWS Config service principal (config.amazonaws.com) with the aws:PrincipalOrgID condition. In the management account, attach a Service Control Policy (SCP) to the organization root that denies config:StopConfigurationRecorder, config:DeleteDeliveryChannel, and config:PutDeliveryChannel actions.
  3. C
    In the Security account, create the S3 bucket with S3 Object Lock enabled in Compliance mode. Configure a bucket policy that grants only the s3:PutObject permission to the AWS Config service principal (config.amazonaws.com) and restricts access using the aws:PrincipalOrgID condition. In the Security account, create a KMS customer managed key (CMK) and configure its key policy to allow kms:GenerateDataKey* and kms:Decrypt for the AWS Config service principal (config.amazonaws.com) with the aws:PrincipalOrgID condition. Set the bucket default encryption to use this KMS CMK. In the management account, attach a Service Control Policy (SCP) to the organization root that denies config:StopConfigurationRecorder, config:DeleteDeliveryChannel, and config:PutDeliveryChannel actions.
  4. D
    In the Security account, create the S3 bucket with S3 Object Lock enabled in Compliance mode. Leave the S3 bucket policy and KMS key policy with default settings. In the Security account, create a KMS customer managed key (CMK) and set it as the default encryption key for the bucket. In the management account, attach a Service Control Policy (SCP) to the organization root that allows member accounts to write objects to the S3 bucket and use the KMS CMK in the Security account, while denying config:StopConfigurationRecorder, config:DeleteDeliveryChannel, and config:PutDeliveryChannel actions.

Cevap

In the Security account, create the S3 bucket with S3 Object Lock enabled in Compliance mode. Configure a bucket policy that grants the s3:PutObject and s3:GetBucketAcl permissions to the AWS Config service principal (config.amazonaws.com) and restricts access using the aws:PrincipalOrgID condition. In the Security account, create a KMS customer managed key (CMK) and configure its key policy to allow kms:GenerateDataKey* and kms:Decrypt for the AWS Config service principal (config.amazonaws.com) with the aws:PrincipalOrgID condition. Set the bucket default encryption to use this KMS CMK. In the management account, attach a Service Control Policy (SCP) to the organization root that denies config:StopConfigurationRecorder, config:DeleteDeliveryChannel, and config:PutDeliveryChannel actions.
The correct solution uses S3 Object Lock in Compliance mode to meet the WORM requirement, preventing even administrative users in the Security account from altering or deleting logs. S3 bucket policies and Customer Managed Key (CMK) policies in the Security account must explicitly grant access to the AWS Config service principal (config.amazonaws.com) using the aws:PrincipalOrgID condition to restrict access to the organization. Additionally, both s3:PutObject and s3:GetBucketAcl are required for AWS Config delivery, and the SCP effectively prevents member accounts from disabling the configuration recorder.

Adım Adım Çözüm

1
Enable S3 Object Lock in Compliance mode on the target bucket in the Security account.
Enforces WORM retention, preventing administrative or root users from deleting or modifying objects in the bucket during the compliance window.
Meets the regulatory security requirement to prevent data tampering of centralized auditing logs.
2
Configure the S3 bucket policy to allow config.amazonaws.com to perform s3:PutObject and s3:GetBucketAcl, restricted by the aws:PrincipalOrgID condition.
Allows AWS Config delivery channels from all member accounts under the organization to verify bucket ownership and write log files.
AWS Config requires both permissions to successfully establish a delivery channel and write configuration records cross-account.
3
Create a Customer Managed Key (CMK) in the Security account, authorize config.amazonaws.com in the key policy, and enable S3 default encryption using this key.
Enables AWS Config service principals in the member accounts to use kms:GenerateDataKey* and kms:Decrypt to write encrypted configuration snapshots to S3.
AWS-managed keys (aws/s3) cannot be shared cross-account, so a Customer Managed Key is required for cross-account KMS encryption.
4
Attach a Service Control Policy (SCP) to the Organization Root that denies config:StopConfigurationRecorder, config:DeleteDeliveryChannel, and config:PutDeliveryChannel.
Prevents administrators in member accounts from turning off auditing or redirecting logs to an alternate destination.
Enforces operational compliance globally across the organization.

Anahtar Kavram

Centralized configuration auditing with AWS Config requires cross-account S3 bucket policies with GetBucketAcl and PutObject permissions, KMS customer managed keys with service principal delegation, S3 Object Lock for WORM compliance, and Service Control Policies to enforce governance.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Centralized Monitoring, Logging, and Auditing Solutions

Bu konudan daha fazla soru