Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 112 discussion

I go with BD, because each Member Account has to write into the security Account S3 bucket, not only the Organization Management Account. https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-set-bucket-policy-for-multiple-accounts.html

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/creating-trail-organization.html According to the official documentation, when an organization trail is created, the management account collects logs from all member accounts and stores them in the specified S3 bucket on their behalf.

The management account's CloudTrail service will automatically write logs from all member accounts to the centralized bucket. Member accounts should not have direct write access to the logging bucket to maintain security and integrity of the logs. "By default, organization log files are accessible only to the management account. For information about how to allow read access to the Amazon S3 bucket for IAM users in member accounts, see Sharing CloudTrail log files between AWS accounts." https://docs.aws.amazon.com/awscloudtrail/latest/userguide/create-s3-bucket-policy-for-cloudtrail.html#org-trail-bucket-policy

A and D

To all who are choosing B, the answer is A. Here's the reasoning: In an AWS Organizations setup, the management account can be configured to collect CloudTrail logs from all member accounts and forward them to a centralized Amazon S3 bucket in a dedicated security account. This centralized logging approach ensures that all account activity across the organization is captured and securely stored.

B and D

B increases the surface area for potential security issues since multiple member accounts have write access to the bucket.

AD. A and not B because, member account number tracking does not make sense, when it's easy to use single Org as reference for Bucket policy.

The organization includes a dedicated security account= Member account while ALL OTHER =Management account. this means to me that granting the permission from the Management account reduces operational overhead than doing it at individual member accounts. Therefore I go with option AD.

A, D Option B covers the storage aspect by configuring a dedicated S3 bucket in the security account, allowing member accounts to write logs. S3 Object Lock in compliance mode ensures the retention requirements. Option D complements this by configuring CloudTrail to capture the logs and deliver them to the dedicated S3 bucket directly. Together, these options cover the log storage, retention, and collection requirements with the least operational overhead.

Enable Organization Trail: In the Management Console or CLI, activate an organization trail that logs all events from all member accounts. https://docs.aws.amazon.com/awscloudtrail/latest/userguide/creating-trail-organization.html

Member account needs to write to S3.

trails across member accounts, needs permissions to the sender bucket

If I understand correctly, the reason why the option B can't be a correct one cuz the use case has asked about the logs which must not be deleted or changed which can't be met in option B if we opt for each member's accounts to be given with the full S3 logs access under an organization.

A and D are correct

correct