Examkin

Soru

Zorluk: Çok zorSecurity Monitoring, Logging, and Compliance Auditing

An enterprise requires a centralized security auditing strategy across its multi-account environment. A SysOps Administrator is tasked with configuring a multi-region trail that delivers logs to a central Amazon S3 bucket located in a dedicated logging account. The logs must be encrypted at rest using an AWS Key Management Service (AWS KMS) customer managed key. Which two configuration steps are required to establish this secure logging and monitoring flow? (Select TWO.)

  1. Attach a policy to the KMS key that grants `kms:GenerateDataKey*` and `kms:DescribeKey` permissions to the `cloudtrail.amazonaws.com` service principal, restricting the source trail using the `aws:SourceArn` condition.Cevap
  2. Configure the S3 bucket policy in the logging account to allow the `cloudtrail.amazonaws.com` service principal to perform `s3:PutObject` operations, requiring the `s3:x-amz-acl` condition to be set to `bucket-owner-full-control`.Cevap
  3. C
    Configure an IAM role with `iam:PassRole` permissions that allows the CloudTrail service to assume the credentials of the logging account's administrator when writing to the S3 bucket.
  4. D
    Enable detailed monitoring on the logging S3 bucket to monitor CloudTrail delivery operations and verify metric granularity at 1-minute intervals.
  5. E
    Configure an EventBridge rule that detects CloudTrail delivery failures and targets an IAM role to automatically remediate bucket permission errors.

Cevap

The correct configuration requires attaching a KMS key policy that permits `kms:GenerateDataKey*` and `kms:DescribeKey` to the CloudTrail service principal with an `aws:SourceArn` condition, and configuring the S3 bucket policy in the logging account to permit `s3:PutObject` operations from the CloudTrail service principal with the `bucket-owner-full-control` ACL condition.
The correct steps involve granting CloudTrail the necessary permissions to write logs to the target S3 bucket and encrypt them using the KMS customer managed key. The S3 bucket policy must allow `s3:PutObject` with the `bucket-owner-full-control` ACL requirement so that the destination logging account owns the logs. The KMS key policy must allow `kms:GenerateDataKey*` and `kms:DescribeKey` to encrypt the logs, restricted by `aws:SourceArn` for security.

Adım Adım Çözüm

1
Configure S3 permissions for CloudTrail log delivery
The S3 bucket policy is updated to allow `s3:PutObject` from `cloudtrail.amazonaws.com` and enforces the `s3:x-amz-acl` header to ensure bucket owner full control.
This allows CloudTrail to write log files into the centralized bucket across accounts while retaining ownership of the objects in the logging account.
2
Configure KMS key policy for CloudTrail encryption
The customer managed key policy is updated to grant `kms:GenerateDataKey*` and `kms:DescribeKey` permissions to `cloudtrail.amazonaws.com` with `aws:SourceArn` condition.
This allows CloudTrail to encrypt the log files before putting them into the S3 bucket using a secure, trail-restricted key.

Anahtar Kavram

CloudTrail log encryption and S3 delivery access control using resource-based policies.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Security Monitoring, Logging, and Compliance Auditing

Bu konudan daha fazla soru