An enterprise is designing a centralized auditing solution for its AWS Organization, which contains member accounts. The security team wants to enable AWS CloudTrail for all accounts to log all read and write API activity across all AWS Regions. The log files must be consolidated in a single Amazon S3 bucket located in a dedicated Security account. The logs must be encrypted using a KMS key, and the security team must prevent any member account administrators from disabling or modifying the trail. Which combination of actions should the Solutions Architect take to implement this solution? (Select TWO.)
- Create an AWS CloudTrail organization trail in the Organization management account that sends logs to the central Amazon S3 bucket in the Security account, and apply a Service Control Policy (SCP) to the root of the organization that denies member accounts the ability to delete or modify CloudTrail configurations.Cevap
- Create a KMS customer managed key in the Security account, configure its key policy to allow the CloudTrail service principal to perform key generation and description operations, and update the Amazon S3 bucket policy in the Security account to allow the CloudTrail service principal to write logs.Cevap
- CEnable encryption on the organization trail using the default AWS-managed KMS key (aws/s3) to ensure all log files deposited into the Security account S3 bucket are encrypted at rest without administrative overhead.
- DCreate a Service Control Policy (SCP) that grants the s3:PutObject permission to the CloudTrail service principal and apply it to the member accounts' Organizational Units (OUs) to authorize log delivery to the Security account's S3 bucket.
- EConfigure the S3 bucket policy on the Security account's log bucket to allow the root IAM users of each individual member account permission to perform s3:PutObject actions, specifying each account ID explicitly in the Principal element.
Cevap
Create an AWS CloudTrail organization trail in the Organization management account combined with a Service Control Policy (SCP) to prevent modification, and use a KMS customer managed key in the Security account with policies configured to allow the CloudTrail service principal access.
Centralizing CloudTrail logs requires creating an organization trail, which automatically logs events for all AWS accounts in the organization. To protect the logging configuration, a Service Control Policy (SCP) is applied at the organization root to deny deletion or modification of CloudTrail resources by member accounts. For encryption, a customer managed key is required because AWS-managed keys cannot be shared cross-account or support policy changes. Both the S3 bucket policy and the KMS key policy must explicitly allow the CloudTrail service principal to perform write and key generation operations.
Adım Adım Çözüm
Anahtar Kavram
Centralized auditing using AWS CloudTrail Organization Trails, S3 bucket policies, and cross-account Customer Managed KMS Keys.