Examkin

Soru

Zorluk: OrtaAWS CloudTrail Configuration and Management

A company's security policy requires all API activity logs to be encrypted at rest using a customer managed key (CMK). A SysOps Administrator enables encryption on an existing multi-region CloudTrail trail by specifying the KMS key ARN. Shortly after this change, the administrator notices that new log files are no longer being delivered to the destination Amazon S3 bucket. Which of the following actions will resolve this log delivery failure?

  1. Update the key policy of the customer managed KMS key to grant the AWS CloudTrail service principal permission to perform kms:GenerateDataKey* operations.Cevap
  2. B
    Modify the destination S3 bucket policy to grant kms:GenerateDataKey* permissions directly to the CloudTrail service principal.
  3. C
    Add an IAM policy to the SysOps Administrator's IAM user granting iam:PassRole permission for the customer managed KMS key.
  4. D
    Create an Amazon EventBridge rule that detects CloudTrail delivery failures and invokes an AWS Systems Manager Automation workflow to retry the delivery.

Cevap

Update the key policy of the customer managed KMS key to grant the AWS CloudTrail service principal permission to perform kms:GenerateDataKey* operations.
Updating the key policy of the customer managed KMS key to grant the AWS CloudTrail service principal permission to perform kms:GenerateDataKey* operations is correct because CloudTrail requires this permission to encrypt logs before delivering them to the S3 bucket. Without this key policy statement, log delivery will fail silently or report errors.

Adım Adım Çözüm

1
Analyze the log delivery path of AWS CloudTrail when encryption is enabled.
CloudTrail must encrypt the logs using the specified customer managed KMS key before writing them to the destination S3 bucket.
Log delivery will fail if CloudTrail does not have permissions to generate data keys using the specified KMS key.
2
Determine where service principal permissions are defined for customer managed KMS keys.
Service principal permissions must be defined in the KMS key policy itself.
By default, customer managed KMS keys do not allow external service principals like CloudTrail to use them unless explicitly granted in their key policy.
3
Formulate the required key policy modification.
Allow the cloudtrail.amazonaws.com service principal to execute kms:GenerateDataKey* and kms:DescribeKey actions.
This enables CloudTrail to generate the necessary data keys to encrypt logs upon delivery.

Anahtar Kavram

AWS CloudTrail SSE-KMS Key Policy Requirements
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

AWS CloudTrail Configuration and Management

Bu konudan daha fazla soru