Why Are VPC Flow Logs Not Delivering Cross-Account? KMS Key Policy Issues
A company uses AWS Organizations to manage multiple accounts. The security team needs to implement a centralized logging solution where all VPC Flow Logs from all accounts are sent to a central S3 bucket in the security account. The flow logs must be encrypted with a customer-managed KMS key (CMK) that is owned by the security account. The security engineer has enabled VPC Flow Logs in each account and configured the destination to be the central S3 bucket. However, the flow logs are not being delivered. The engineer checks the S3 bucket policy and confirms that it grants the required permissions to the Flow Logs service principal. What is the MOST likely cause of the failure?
Quick Answer
The answer is the KMS key policy does not grant the Flow Logs service principal permission to use the key. When troubleshooting cross-account VPC flow logs, the most overlooked detail is that the customer-managed KMS key in the security account must explicitly allow the Flow Logs service principal from the source accounts to perform the `kms:GenerateDataKey` and `kms:Decrypt` actions, even if the S3 bucket policy is correctly configured. On the AWS Certified Security Specialty SCS-C02 exam, this scenario tests your understanding that cross-account encryption requires a two-layer permission model: the bucket policy handles write access, but the key policy controls encryption rights, and the default key policy only grants access to the owning account. A common trap is assuming the bucket policy alone suffices or that CloudTrail is involved. Remember the memory tip: "Key first, bucket second" — always verify the KMS key policy before the S3 bucket policy when flow logs fail to deliver cross-account.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The KMS key policy does not grant the Flow Logs service principal permission to use the key.
The KMS key policy must grant the VPC Flow Logs service principal (flow-logs.amazonaws.com) permission to use the customer-managed key for encryption. The engineer verified the S3 bucket policy, so the missing KMS key policy is the most likely cause. Option A is incorrect because VPC Flow Logs can deliver to cross-account S3 buckets. Option C is incorrect because CloudTrail is not required for Flow Logs. Option D is incorrect because the S3 bucket policy already grants permissions to the Flow Logs service principal.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The VPC Flow Logs service does not support cross-account delivery.
Why it's wrong here
Cross-account delivery is supported.
- ✓
The KMS key policy does not grant the Flow Logs service principal permission to use the key.
Why this is correct
The key policy must allow the service principal to encrypt.
- ✗
CloudTrail must be enabled in the source account for Flow Logs to work.
Why it's wrong here
CloudTrail is not required for Flow Logs.
- ✗
The S3 bucket policy is missing a condition for source account.
Why it's wrong here
The bucket policy is correct according to the scenario.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS Organizations with multiple accounts. The security team wants to centralize VPC Flow Logs from all accounts into a single S3 bucket in the security account. The flow logs are created in the member accounts and sent to the centralized bucket. However, the security team notices that flow logs from some member accounts are not being delivered. What is the most likely cause?
medium- A.The member accounts need an IAM role with permissions to write to the centralized bucket.
- B.CloudTrail must be enabled in each member account before VPC Flow Logs can be sent to a centralized bucket.
- ✓ C.The S3 bucket policy does not grant write permissions to the member accounts.
- D.VPC Flow Logs cannot be aggregated across multiple AWS accounts.
Why C: VPC Flow Logs are delivered to an S3 bucket using the flow log publisher's IAM role, but the destination bucket must also have a bucket policy that explicitly grants the necessary permissions (e.g., s3:PutObject) to the member accounts' log delivery service. Without this policy, the S3 bucket will reject write requests from member accounts, causing flow logs to fail silently.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.