Why Are VPC Flow Logs Not Delivering Cross-Account? KMS Key Policy Issues
A company uses AWS Organizations to manage multiple accounts. The security team needs to implement a centralized logging solution where all VPC Flow Logs from all accounts are sent to a central S3 bucket in the security account. The flow logs must be encrypted with a customer-managed KMS key (CMK) that is owned by the security account. The security engineer has enabled VPC Flow Logs in each account and configured the destination to be the central S3 bucket. However, the flow logs are not being delivered. The engineer checks the S3 bucket policy and confirms that it grants the required permissions to the Flow Logs service principal. What is the MOST likely cause of the failure?
Quick Answer
The answer is the KMS key policy does not grant the Flow Logs service principal permission to use the key. When troubleshooting cross-account VPC flow logs, the most overlooked detail is that the customer-managed KMS key in the security account must explicitly allow the Flow Logs service principal from the source accounts to perform the `kms:GenerateDataKey` and `kms:Decrypt` actions, even if the S3 bucket policy is correctly configured. On the AWS Certified Security Specialty SCS-C02 exam, this scenario tests your understanding that cross-account encryption requires a two-layer permission model: the bucket policy handles write access, but the key policy controls encryption rights, and the default key policy only grants access to the owning account. A common trap is assuming the bucket policy alone suffices or that CloudTrail is involved. Remember the memory tip: "Key first, bucket second" — always verify the KMS key policy before the S3 bucket policy when flow logs fail to deliver cross-account.
⚠ Common exam trap
SCS-C02 often tests the misconception that S3 bucket policy alone is sufficient for encrypted delivery — candidates forget that KMS key policies are separate and must explicitly grant the service principal access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The KMS key policy does not grant the Flow Logs service principal permission to use the key.
When VPC Flow Logs are delivered to an S3 bucket encrypted with a customer-managed KMS key, the Flow Logs service principal must have permission to use that key. Even if the S3 bucket policy grants access, the KMS key policy must also allow the Flow Logs service to encrypt data. Without this, the delivery fails. This is the most likely cause given the scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The VPC Flow Logs service does not support cross-account delivery.
Why it's wrong here
VPC Flow Logs do support cross-account delivery to S3, so this claim misstates the service's capability and cannot explain the failure. It is tempting because cross-account delivery does require the bucket policy and KMS key policy to grant the log-delivery principal access, which is the actual area to check.
- ✓
The KMS key policy does not grant the Flow Logs service principal permission to use the key.
Why this is correct
VPC Flow Logs encrypts delivered records using the destination CMK, so the Flow Logs service principal needs kms:GenerateDataKey and kms:Decrypt in the key policy. The S3 bucket policy alone cannot grant that KMS access, blocking delivery.
- ✗
CloudTrail must be enabled in the source account for Flow Logs to work.
Why it's wrong here
Flow Logs publish to S3 independently of CloudTrail, so enabling a trail in the source account changes nothing about delivery. It is tempting because CloudTrail is the other major audit-log source and also writes to S3, making it the correct dependency when centralising API activity logs rather than network flow records.
- ✗
The S3 bucket policy is missing a condition for source account.
Why it's wrong here
A source-account condition is optional; the bucket policy already grants the delivery principal permissions, so its absence does not block delivery. Source-account conditions are tempting because they harden bucket policies against confused-deputy access, and would be the right addition when restricting which accounts may write.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,205 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS Organizations with multiple accounts. The security team wants to centralize VPC Flow Logs from all accounts into a single S3 bucket in the security account. The flow logs are created in the member accounts and sent to the centralized bucket. However, the security team notices that flow logs from some member accounts are not being delivered. What is the most likely cause?
medium- A.The member accounts need an IAM role with permissions to write to the centralized bucket.
- B.CloudTrail must be enabled in each member account before VPC Flow Logs can be sent to a centralized bucket.
- ✓ C.The S3 bucket policy does not grant write permissions to the member accounts.
- D.VPC Flow Logs cannot be aggregated across multiple AWS accounts.
Why C: VPC Flow Logs are delivered to an S3 bucket using the flow log publisher's IAM role, but the destination bucket must also have a bucket policy that explicitly grants the necessary permissions (e.g., s3:PutObject) to the member accounts' log delivery service. Without this policy, the S3 bucket will reject write requests from member accounts, causing flow logs to fail silently.
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.