Examkin

Soru

Zorluk: ZorAWS Key Management Service (KMS) and Data Encryption

A SysOps Administrator is setting up an organization-wide AWS CloudTrail trail in Account A (111122223333111122223333). The trail is configured to deliver log files to an Amazon S3 bucket located in Account B (444455556666444455556666). The administrator wants to encrypt these log files using a customer managed KMS key that is also located in Account B. The S3 bucket policy in Account B has already been configured to allow the `cloudtrail.amazonaws.com` service principal to write logs. However, when the administrator enables KMS encryption on the trail using the KMS key from Account B, CloudTrail log delivery fails.

Which configuration change must the administrator make to resolve this delivery issue?

  1. Modify the KMS key policy in Account B to allow the `cloudtrail.amazonaws.com` service principal to perform `kms:GenerateDataKey*` and `kms:DescribeKey` actions, with a condition matching the trail ARN from Account A in the `kms:EncryptionContext:aws:cloudtrail:arn` key.Cevap
  2. B
    Configure an IAM role in Account A with permissions to use the KMS key in Account B, and modify the CloudTrail configuration to assume this role when delivering logs.
  3. C
    Attach a customer managed IAM policy to the CloudTrail service-linked role in Account A that allows `kms:GenerateDataKey*` and `kms:DescribeKey` actions on the Account B KMS key resource.
  4. D
    Modify the S3 bucket policy in Account B to include `kms:GenerateDataKey*` permissions within the statement that allows CloudTrail to write to the bucket.

Cevap

Modify the KMS key policy in Account B to allow the `cloudtrail.amazonaws.com` service principal to perform `kms:GenerateDataKey*` and `kms:DescribeKey` actions, with a condition matching the trail ARN from Account A in the `kms:EncryptionContext:aws:cloudtrail:arn` key.
To allow AWS CloudTrail (a service running on behalf of Account A) to encrypt log files using a KMS key in Account B, the KMS key policy in Account B must explicitly permit the `cloudtrail.amazonaws.com` service principal to use the key. Specifically, CloudTrail requires the `kms:GenerateDataKey*` action to generate data keys for encrypting the log objects, and `kms:DescribeKey` to check key properties. Additionally, using the `kms:EncryptionContext:aws:cloudtrail:arn` condition key restricts key usage to the specific trail in Account A, ensuring proper security boundaries.

Adım Adım Çözüm

1
Analyze the log delivery path and identify why CloudTrail cannot deliver logs.
CloudTrail in Account A must write encrypted logs to Account B. Since encryption is enabled with a customer managed key in Account B, the CloudTrail service principal requires access to that KMS key to generate data keys.
Without key access, CloudTrail cannot encrypt the logs, resulting in failed log delivery.
2
Determine where the KMS permissions must be configured.
Because the KMS key is in Account B and the service runs on behalf of a resource in Account A, the KMS key policy in Account B must be updated to grant permissions directly to the `cloudtrail.amazonaws.com` service principal.
KMS key policies are the primary authorizers for KMS key usage; IAM policies in an external account cannot grant access to a KMS key without the key policy itself permitting it.
3
Verify the required KMS policy actions and conditions.
The key policy must allow `kms:GenerateDataKey*` and `kms:DescribeKey` actions to the service principal, and restrict usage to the specific trail using the `kms:EncryptionContext:aws:cloudtrail:arn` condition key.
CloudTrail requires these specific actions to perform envelope encryption on the log files before writing them, and the condition prevents unauthorized accounts or trails from using the key.

Anahtar Kavram

Cross-account AWS Service access to KMS CMKs requires explicit configuration of the KMS key policy to permit the service principal, constrained by specific encryption contexts.
Bu soruyu puanla

Konular

AWS Key Management Service (KMS) and Data Encryption

Bu konudan daha fazla soru