An enterprise manages AWS accounts using AWS Organizations. The security team wants to enable a centralized audit trail using AWS CloudTrail to record all API activity across all accounts. The logs must be stored in a central Amazon S3 bucket located in a dedicated Security account. All logs must be encrypted at rest using an AWS KMS key. The solution must ensure that new accounts created within the organization are automatically included in the trail, and that member accounts cannot modify or delete the logging configuration.
Which approach should the Solutions Architect implement to meet these requirements securely?
- ACreate an Amazon S3 bucket and a customer managed KMS key in the Security account. In the Organizations management account, create an organization trail. In each member account, configure an IAM role with write permissions to the central S3 bucket and use the customer managed KMS key.
- Create an Amazon S3 bucket in the Security account with a bucket policy that grants s3:PutObject and s3:GetBucketAcl permissions to the CloudTrail service principal, restricted by the aws:PrincipalOrgID condition. Create a customer managed KMS key in the Security account with a key policy that allows CloudTrail to use kms:GenerateDataKey* and kms:DescribeKey. Create an organization trail in the Organizations management account that points to the central S3 bucket and uses the customer managed KMS key.Cevap
- CCreate an Amazon S3 bucket in the Security account with a bucket policy that grants s3:PutObject and s3:GetBucketAcl permissions to the CloudTrail service principal, restricted by the aws:PrincipalOrgID condition. Create an organization trail in the Organizations management account that points to the central S3 bucket, and enable default encryption using the AWS managed KMS key aws/cloudtrail.
- DCreate an Amazon S3 bucket and a customer managed KMS key in the Security account. Create a Service Control Policy (SCP) at the Organization root that grants the CloudTrail service permission to perform write operations to the central S3 bucket and use the KMS key, and attach this SCP to all member OUs. In the Organizations management account, create an organization trail.
Cevap
To securely centralize CloudTrail logging across an AWS Organization, the Solutions Architect must deploy an organization trail, use a centralized S3 bucket with a bucket policy that permits cross-account CloudTrail delivery using the aws:PrincipalOrgID condition, and encrypt the logs using a customer managed KMS key with a policy configured to allow CloudTrail access from all member accounts.
The correct solution uses an organization trail, which automatically logs events across all member accounts (including newly created ones) and prevents local modification by member accounts. Log aggregation is secured via a resource-based S3 bucket policy in the Security account that restricts writes to the organization's accounts using the aws:PrincipalOrgID condition. Encryption uses a customer managed key with a custom key policy, which is required because the default AWS managed key (aws/cloudtrail) does not allow policy modification to support cross-account operations.
Adım Adım Çözüm
Anahtar Kavram
Centralized auditing and logging using AWS Organizations organizational trails, S3 bucket policies, and cross-account customer managed KMS keys.
Tahmini Süre:2m 0s