Examkin

Soru

Zorluk: OrtaAWS CloudTrail Configuration and Management

A SysOps Administrator is troubleshooting log delivery for an AWS Organizations trail configured in the management account (111122223333). The trail is configured to log API events for all member accounts, deliver logs to a centralized Amazon S3 bucket named central-trail-logs, and encrypt the logs using a customer managed AWS KMS key. Currently, no logs are appearing in the S3 bucket, and CloudTrail logs show delivery errors. Which two configuration updates are required to resolve this issue? (Select TWO.)

  1. Update the S3 bucket policy on central-trail-logs to allow the cloudtrail.amazonaws.com service principal to perform the s3:PutObject action on arn:aws:s3:::central-trail-logs/AWSLogs/* and the s3:GetBucketAcl action on the bucket resource.Cevap
  2. Update the KMS key policy to allow the cloudtrail.amazonaws.com service principal to perform the kms:GenerateDataKey* and kms:Decrypt actions, with a condition matching the trail ARN in the encryption context.Cevap
  3. C
    Create an IAM role with iam:PassRole permissions attached to the SysOps Administrator's IAM user policy to delegate S3 and KMS permissions to the CloudTrail service.
  4. D
    Modify the S3 bucket policy on central-trail-logs to grant the s3:PutObject permission directly to the SysOps Administrator's IAM role, since CloudTrail executes API calls under the credentials of the user who created the trail.
  5. E
    Configure an Amazon EventBridge rule that triggers an AWS Systems Manager Automation execution role to assume the target role and write logs directly to the S3 bucket whenever a write event is recorded.

Cevap

Update the S3 bucket policy to allow the CloudTrail service principal to perform s3:PutObject and s3:GetBucketAcl, and update the KMS key policy to allow the CloudTrail service principal to perform kms:GenerateDataKey* and kms:Decrypt.
AWS CloudTrail requires explicit permissions to write logs to an Amazon S3 bucket and to use a customer managed KMS key for encryption. Specifically, the S3 bucket policy must allow the CloudTrail service principal (cloudtrail.amazonaws.com) to perform s3:PutObject on the log file prefix (such as arn:aws:s3:::central-trail-logs/AWSLogs/*) and s3:GetBucketAcl on the bucket. If the logs are encrypted using a customer managed KMS key, the KMS key policy must also explicitly allow the CloudTrail service principal to perform the kms:GenerateDataKey* and kms:Decrypt actions, with a condition verifying the CloudTrail ARN in the encryption context. Without both policy configurations, log delivery will fail.

Adım Adım Çözüm

1
Verify and update the S3 bucket policy on the destination bucket.
The bucket policy is updated to grant the cloudtrail.amazonaws.com service principal the s3:PutObject permission for the log path and the s3:GetBucketAcl permission for the bucket itself.
This allows CloudTrail to verify bucket ownership and write log files to the S3 bucket.
2
Verify and update the KMS key policy of the customer managed key used for encryption.
The key policy is updated to grant the cloudtrail.amazonaws.com service principal the kms:GenerateDataKey* and kms:Decrypt permissions with a condition matching the trail ARN in the encryption context.
This allows CloudTrail to encrypt the logs before storing them in S3.

Anahtar Kavram

CloudTrail log delivery permissions requiring service principal access in S3 bucket policies and KMS key policies.
Bu soruyu puanla

Konular

AWS CloudTrail Configuration and Management

Bu konudan daha fazla soru