Examkin

Soru

Zorluk: OrtaVPC Security Controls and Traffic Analysis

A SysOps Administrator is configuring VPC Flow Logs for a multi-tier application. The administrator creates a flow log to capture all traffic and selects an Amazon S3 bucket named 'app-traffic-logs-prod' in the same AWS account as the destination. The S3 bucket is configured with default Amazon S3 managed encryption keys (SSE-S3). Shortly after creation, the administrator checks the S3 bucket but finds that no flow log data has been delivered. Which of the following explains why the logs are failing to deliver?

  1. A
    The IAM user who created the flow log does not have the iam:PassRole permission for the log delivery role.
  2. B
    The S3 bucket has not been configured with an active object lifecycle policy, causing AWS to block delivery to prevent unlimited log storage accumulation.
  3. The bucket policy on the Amazon S3 bucket does not grant s3:PutObject permissions to the log delivery service principal (delivery.logs.amazonaws.com).Cevap
  4. D
    The S3 bucket is encrypted using a Customer Managed Key (CMK) and the administrator attempted to grant access via an IAM user policy rather than modifying the KMS key policy.

Cevap

The bucket policy on the Amazon S3 bucket does not grant s3:PutObject permissions to the log delivery service principal (delivery.logs.amazonaws.com).
The correct answer is that the bucket policy on the destination S3 bucket must explicitly grant 's3:PutObject' and 's3:GetBucketAcl' permissions to the AWS Log Delivery service principal ('delivery.logs.amazonaws.com'). S3 bucket log delivery is cross-service and does not use an IAM role or role delegation.

Adım Adım Çözüm

1
Analyze the destination target of the VPC Flow Logs.
The destination is an Amazon S3 bucket using default server-side encryption (SSE-S3).
This determines which authorization mechanism is evaluated by AWS.
2
Determine the service integration requirements for S3 log delivery.
VPC Flow Logs deliver data to S3 using the Log Delivery service principal (delivery.logs.amazonaws.com), which requires S3 bucket policy permissions.
This rules out IAM roles and PassRole permissions since S3 delivery bypasses IAM roles.
3
Check the encryption configuration.
SSE-S3 is used, meaning no customer-managed KMS key policies need to be updated.
This eliminates KMS key policy restriction errors from being the root cause.

Anahtar Kavram

VPC Flow Logs S3 delivery permissions
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

VPC Security Controls and Traffic Analysis

Bu konudan daha fazla soru