A SysOps Administrator is configuring a new AWS CloudTrail trail to deliver log files to an Amazon S3 bucket. The logs must be encrypted using a customer managed AWS KMS key. After configuring the trail, the administrator notices that CloudTrail is failing to deliver logs to the S3 bucket. Which of the following configuration changes must the administrator make to resolve this issue? (Select two.)
- Modify the Amazon S3 bucket policy to allow the cloudtrail.amazonaws.com service principal to perform the s3:PutObject action on the log path.Cevap
- Modify the customer managed KMS key policy to allow the cloudtrail.amazonaws.com service principal to perform the kms:GenerateDataKey* action.Cevap
- CAttach an IAM policy to the SysOps Administrator's IAM role that grants kms:GenerateDataKey* access to the key, without modifying the KMS key policy.
- DConfigure the Amazon S3 bucket policy to only allow the cloudtrail.amazonaws.com service principal to perform s3:GetObject and s3:ListBucket actions.
Cevap
Modify the Amazon S3 bucket policy to allow the cloudtrail.amazonaws.com service principal to perform the s3:PutObject action on the log path, and modify the customer managed KMS key policy to allow the cloudtrail.amazonaws.com service principal to perform the kms:GenerateDataKey* action.
For CloudTrail to deliver logs encrypted with a customer managed KMS key, both the destination S3 bucket and the KMS key must have resource-based policies that grant access to the CloudTrail service principal. Specifically, the S3 bucket policy must allow s3:PutObject, and the KMS key policy must allow kms:GenerateDataKey*.
Adım Adım Çözüm
Anahtar Kavram
AWS CloudTrail log delivery requires specific resource-based policy configurations on both S3 buckets (for write access) and KMS keys (for encryption capabilities).