SAP-C02 Question 126
Single answerA company is designing a multi-account AWS environment to improve security, scalability, and cost management. The solution architect is tasked with setting up cross-account access for a centralized logging account to collect logs from all other accounts. To achieve this, the architect wants to use AWS Organizations and ensure minimal manual configuration in each account. Which approach should the architect use?
- A
Use AWS CloudTrail to send logs directly to the centralized logging account by enabling cross-account delivery in each member account.
- B
Use AWS Organizations Service Control Policies (SCPs) to enforce centralized logging across all accounts.
- C
Configure an AWS IAM role with cross-account access in the centralized logging account and use AWS CloudFormation StackSets to deploy the required permissions in each member account.
- D
Manually configure each member account's CloudWatch Logs to send data to the centralized logging account.
Show answer and explanation
Correct answer: C
Explanation
The most efficient and scalable approach to set up cross-account logging in a multi-account AWS environment is to use AWS CloudFormation StackSets. This allows the centralized logging account to manage cross-account IAM roles and permissions across all member accounts programmatically. Other options either lack the required functionality, are overly manual, or are not suitable for this scenario.
- A. Incorrect.
AWS CloudTrail does not support automatically sending logs to a centralized account through cross-account delivery. It requires manual configuration or additional tools to achieve this.
- B. Incorrect.
Service Control Policies (SCPs) are used to restrict or control permissions across accounts in AWS Organizations, but they cannot enforce logging configurations or manage cross-account access.
- C. Correct.
Using AWS CloudFormation StackSets to deploy the required permissions in each member account is the most scalable and automated solution. It ensures that the centralized logging account has the necessary IAM roles for cross-account access, reducing manual effort.
- D. Incorrect.
Manually configuring each member account's CloudWatch Logs to send data to the centralized logging account is error-prone and inefficient, especially as the number of accounts grows.