A SysOps Administrator is configuring an AWS CloudTrail organization trail from the organization's management account to log all API activity across all member accounts. The trail is configured to deliver logs to a centralized Amazon S3 bucket. While logs from the management account are successfully appearing in the S3 bucket, no logs from the member accounts are being delivered. Which of the following is the most likely cause of this issue?
- The S3 bucket policy restricts the s3:PutObject permission to the resource path prefix containing the management account ID instead of the AWS Organization ID.Cevap
- BThe S3 bucket policy is missing the s3:GetBucketAcl permission for the cloudtrail.amazonaws.com service principal.
- CThe IAM policy associated with the SysOps Administrator in the management account is missing the iam:PassRole permission to pass the CloudTrail service role to member accounts.
- DAn Amazon EventBridge rule must be created in each member account to forward the CloudTrail log events to the central management account's S3 bucket.
Cevap
The S3 bucket policy restricts the s3:PutObject permission to the resource path prefix containing the management account ID instead of the AWS Organization ID.
The correct answer is that the S3 bucket policy restricts the s3:PutObject permission to the resource path prefix containing the management account ID instead of the AWS Organization ID. When an organization trail is created, CloudTrail writes log files from member accounts to the S3 bucket under the prefix 'AWSLogs/o-organizationId/'. If the S3 bucket policy only grants 's3:PutObject' access to the path prefix containing the management account ID, log delivery for all other member accounts will be blocked, while the management account's logs might still be delivered if a specific rule allowed them.
Adım Adım Çözüm
Anahtar Kavram
AWS CloudTrail Organization Trail S3 Bucket Policies