SCS-C02 Question 359
Select 3Your organization leverages AWS Organizations with multiple accounts and has enabled AWS CloudTrail in the management account. You are tasked with ensuring that every member account in the organization has CloudTrail logs automatically sent to a centralized S3 bucket in the management account. Additionally, you must ensure no one in member accounts can delete or modify the logs in the S3 bucket. Which of the following steps should you take to meet this requirement?
- A
Configure an organization trail in AWS CloudTrail from the management account and enable it for all accounts in the organization.
- B
Create an S3 bucket in the management account with a bucket policy that grants write access to CloudTrail logs from all member accounts.
- C
Enable the S3 bucket's default encryption to prevent unauthorized access to the logs.
- D
Use the S3 bucket's Object Lock feature to enforce write-once-read-many (WORM) policies for the CloudTrail logs.
- E
Manually configure CloudTrail in each member account to send logs to the centralized S3 bucket.
Show answer and explanation
Correct answers: A, B, D
Explanation
To meet the requirements, you need to enable an organization trail to centralize CloudTrail logging across all accounts and configure the S3 bucket to receive these logs. The bucket policy must allow write access for CloudTrail logs from all accounts, and the S3 Object Lock feature is required to ensure that the logs cannot be deleted or modified. Manually configuring CloudTrail in each member account is redundant when using an organization trail, and while S3 default encryption is useful, it does not address the immutability requirement.
- A. Correct.
This is correct. An organization trail in AWS CloudTrail ensures that logs are automatically collected from all accounts in the organization and sent to the centralized S3 bucket.
- B. Correct.
This is correct. The S3 bucket must have a bucket policy that allows CloudTrail to write logs from all member accounts to ensure centralized log storage.
- C. Incorrect.
This is incorrect. While enabling default encryption is a good security practice, it does not directly address the requirement to prevent deletion or modification of logs.
- D. Correct.
This is correct. The S3 Object Lock feature ensures that logs cannot be deleted or altered, which satisfies the requirement for log immutability.
- E. Incorrect.
This is incorrect. Manually configuring CloudTrail in each member account is unnecessary when an organization trail is enabled, as the latter automates the process.