Examkin

Soru

Zorluk: OrtaTroubleshooting Monitoring, Logging, and Permissions

A SysOps administrator is configuring an AWS CloudTrail organizational trail to log events across all accounts in an AWS Organization. The trail is configured to deliver logs to a centralized Amazon S3 bucket in a dedicated log archive account. The S3 bucket is encrypted using a customer managed AWS KMS key. After configuring the trail, the administrator notices that log files are not appearing in the S3 bucket, and CloudTrail shows a log delivery failure status.

Which action should the administrator take to resolve this issue?

  1. Update the KMS key policy of the customer managed key to allow the CloudTrail service principal (cloudtrail.amazonaws.com) to perform the kms:GenerateDataKey* action.Cevap
  2. B
    Attach an IAM policy to the CloudTrail service-linked role in each member account that grants the kms:GenerateDataKey* permission on the customer managed key.
  3. C
    Add an iam:PassRole permission to the administrator's IAM policy for the CloudTrail service role to delegate key access.
  4. D
    Enable detailed monitoring on the centralized Amazon S3 bucket to allow CloudTrail metrics to update at one-minute intervals.

Cevap

Update the KMS key policy of the customer managed key to allow the CloudTrail service principal (cloudtrail.amazonaws.com) to perform the kms:GenerateDataKey* action.
Updating the KMS key policy of the customer managed key to allow the CloudTrail service principal (cloudtrail.amazonaws.com) to perform the kms:GenerateDataKey* action allows CloudTrail to encrypt the logs before writing them to the bucket. Because a customer managed key is used, the key policy must explicitly authorize CloudTrail to use the key.

Adım Adım Çözüm

1
Analyze the error condition.
CloudTrail delivery fails to an S3 bucket encrypted with a customer managed KMS key.
CloudTrail needs permission to generate data keys to encrypt logs using the customer managed KMS key before writing them to the bucket.
2
Identify the policy that controls customer managed KMS key access.
The KMS key policy is the primary authority for customer managed keys and must explicitly allow the CloudTrail service principal.
IAM policies alone cannot grant access to a KMS key if the key policy itself does not authorize the principal or delegate access to the IAM account.
3
Configure the required policy modification.
Add a statement to the KMS key policy allowing the 'cloudtrail.amazonaws.com' principal to perform 'kms:GenerateDataKey*'.
This establishes the necessary trust and permission for CloudTrail to encrypt and deliver log files to the S3 bucket.

Anahtar Kavram

AWS KMS key policy configuration for CloudTrail log delivery
Bu soruyu puanla

Konular

Troubleshooting Monitoring, Logging, and Permissions

Bu konudan daha fazla soru