A regional bank runs 45 AWS accounts in one organization. Its security team keeps a log archive account, and its central policy is that no member account may change or delete the organization's audit logs, even for an administrator in that account.
The management account must create one trail that covers every account and Region. The logs must be delivered to an Amazon S3 bucket in the log archive account, encrypted with a customer managed AWS KMS key. Only CloudTrail may write to the bucket, and only for this organization.
Which configuration meets these requirements MOST securely?
Choose one answer.
AA. Have each member account create its own trail that writes to the log archive bucket. Use default S3 encryption with Amazon S3 managed keys so that the trails need no key policy changes.
BB. Create one organization trail in the management account that delivers to the log archive bucket. Add a key policy statement for CloudTrail, and a bucket policy that limits writes with aws:SourceArn.
CC. Create one organization trail in the management account, but write it to a bucket in the management account so the security team does not need access to the log archive account.
DD. Create one organization trail in the management account that delivers to the log archive bucket. Grant the bucket policy a wildcard principal with no conditions, so that every account can write its trail.
Show the answer and explanation
Answer: B
A. Wrong: Per-account trails can write to the bucket, but member accounts can stop or change their own trails, which breaks the central control. S3 managed keys also do not meet the requirement for a customer managed KMS key. Learn more: Creating a trail for an organization (opens in a new tab)
B. Right: Correct. An organization trail covers every account and Region from one place, and member accounts cannot stop or change it. The key policy lets CloudTrail encrypt with the customer managed key, and the aws:SourceArn condition limits writes to this organization trail. Learn more: Creating a trail for an organization (opens in a new tab)
C. Wrong: The trail itself is correct, but the logs would sit in the management account. That breaks the central policy that the log archive account holds the audit logs and is the only place they are written.
D. Wrong: A wildcard principal with no conditions lets any AWS account write to the bucket, which breaks the rule that only this organization may write. The trail is correct, but the bucket would accept writes from anyone.
Explanation
An organization trail, created once in the management account, covers every account and Region, and member accounts cannot switch it off. The bucket and key policies must let CloudTrail write, with conditions that limit writes to the organization trail and encryption to the customer managed key. Per-account trails, a bucket in the wrong account and a wildcard principal each break a stated requirement.
The trail lives in the management account, so member accounts cannot turn it off, and the bucket and key policies allow only that trail.
Want more on Organization-wide logging (CloudTrail organization trails, log archive account)? The 5 full-length practice sets have 7 more Organization-wide logging (CloudTrail organization trails, log archive account) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →