Examkin

Soru

Zorluk: ZorCentralized Monitoring, Logging, and Auditing Solutions

A healthcare software-as-a-service (SaaS) provider uses AWS Organizations to manage 110110 member accounts. To meet strict regulatory auditing requirements, a Solutions Architect must design a solution that automatically aggregates AWS CloudTrail logs from all AWS Regions and all current and future member accounts. The logs must be stored in a single centralized Amazon S3 bucket located in a dedicated security operations account. The architecture must enforce that all logs are encrypted at rest using a customer managed KMS key. To prevent tampering, administrators of the member accounts must not have permission to decrypt the stored logs, nor should they be able to modify or delete the logging configuration. Which TWO actions must the Solutions Architect take to design a secure and compliant centralized logging architecture? (Select TWO.)

  1. Configure the S3 bucket policy in the dedicated security operations account to allow the "cloudtrail.amazonaws.com" service principal to perform "s3:PutObject" actions, restricted by a condition checking the organization ID. Configure the customer managed KMS key policy in the security operations account to allow "cloudtrail.amazonaws.com" to perform "kms:GenerateDataKey*" and "kms:DescribeKey" actions, restricted by the same organization ID condition.Cevap
  2. Create an organization trail from the management account (or delegated administrator account) of the AWS Organization. Configure the trail to deliver log files to the centralized S3 bucket in the dedicated security operations account, and configure it to use the Amazon Resource Name (ARN) of the customer managed KMS key located in the security operations account for encryption.Cevap
  3. C
    Deploy a Service Control Policy (SCP) to all organizational units (OUs) that allows member accounts to write logs to the centralized S3 bucket, and configure each member account to assume a role in the security operations account to run local CloudTrail trails.
  4. D
    Enable default S3 bucket encryption on the centralized S3 bucket using the AWS-managed KMS key (aws/s3). Rely on AWS-managed S3 bucket keys to automatically handle cross-account key permissions and ensure that member accounts are restricted from decrypting the logs.
  5. E
    Create an S3 bucket policy in the dedicated security operations account that grants "s3:PutObject" permissions to the root principal of each member account, and use S3 Object Lock in compliance mode to prevent the member accounts from reading or modifying the files.

Cevap

Configure the S3 bucket policy in the dedicated security operations account to allow the CloudTrail service principal to perform write actions restricted by the organization ID, and configure the customer managed KMS key policy to allow CloudTrail to generate data keys. Additionally, create an organization trail from the management account or delegated administrator account, pointing to the centralized S3 bucket and the customer managed KMS key.
The correct architecture requires creating an organization trail from the management account or a delegated administrator account. This automatically configures and deploys CloudTrail across all member accounts (including future ones) and prevents local member account administrators from disabling or modifying the configuration. Additionally, the centralized S3 bucket policy and the KMS key policy in the security operations account must allow the 'cloudtrail.amazonaws.com' service principal to perform 's3:PutObject' and 'kms:GenerateDataKey*'/'kms:DescribeKey' actions respectively, scoped by the organization ID using the 'aws:PrincipalOrgID' condition. This allows cross-account log delivery and encryption while preventing member accounts from decrypting the logs.

Adım Adım Çözüm

1
Set up S3 bucket permissions and KMS key policies in the dedicated security operations account.
The centralized S3 bucket has a policy permitting 's3:PutObject' by the 'cloudtrail.amazonaws.com' service principal under the condition that the 'aws:PrincipalOrgID' matches the AWS Organization ID. The customer managed KMS key has a policy permitting 'kms:GenerateDataKey*' and 'kms:DescribeKey' for the CloudTrail service principal under the same condition, without granting decrypt permissions to the member accounts.
Allows CloudTrail to write logs and generate data keys for encryption across all accounts under the organization, while preventing member account access to decrypt the logs.
2
Create an organization trail from the organization's management account or a delegated administrator account.
An organization trail is established, which automatically propagates to all current and future member accounts across all AWS Regions.
Ensures complete visibility and logging compliance for the entire organization, prevents local administrators in member accounts from modifying or deleting the trail configuration, and directs logs to the centralized S3 bucket.

Anahtar Kavram

Centralized cross-account auditing using AWS Organizations, organization trails, and customer managed KMS keys.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Centralized Monitoring, Logging, and Auditing Solutions

Bu konudan daha fazla soru