Examkin

Question

Difficulty: HardIAM Policies and Roles

An enterprise application running on Amazon EC2 instances in Account A must retrieve database archives from an Amazon S3 bucket located in Account B. The bucket, named `corporate-db-archives`, uses a customer managed key (CMK) in AWS KMS for server-side encryption. The EC2 instances are associated with an IAM role in Account A named `ArchiveReaderRole`. A developer has already attached a permissions policy to `ArchiveReaderRole` that permits S3 read operations on the bucket and KMS decrypt operations on the CMK. Which two resource-based policies in Account B must be updated to successfully authorize this cross-account read operation? (Select two.)

  1. The S3 bucket policy of `corporate-db-archives` to grant S3 read permissions to the IAM role `ArchiveReaderRole` in Account AAnswer
  2. The KMS key policy of the CMK to grant decrypt permissions to the IAM role `ArchiveReaderRole` in Account AAnswer
  3. C
    The trust policy of `ArchiveReaderRole` in Account A to trust the S3 service principal (`s3.amazonaws.com`)
  4. D
    The trust policy of the KMS key in Account B to trust the IAM role `ArchiveReaderRole` in Account A as an entity that can assume the key
  5. E
    The user permissions policy of a new IAM user in Account B, using its static access credentials to configure the EC2 application code

Answer

The correct resource-based policies to update are the S3 bucket policy of the S3 bucket and the KMS key policy of the customer managed key in Account B to grant access to the IAM role in Account A.
For cross-account access to encrypted S3 resources, the resource-based policies in the destination account (Account B) must explicitly authorize the external principal from the source account (Account A). Thus, both the S3 bucket policy must allow the read operations and the KMS key policy must allow the decrypt operations for the external IAM role.

Step-by-Step Solution

1
Analyze cross-account authorization requirements.
Identify that cross-account access requires explicit permission in both the caller's identity policy and the target resource's resource-based policies.
Unlike same-account access where an identity policy or a resource policy is sufficient, cross-account access requires evaluation and approval from both sides.
2
Determine S3 resource-based policy changes.
Update the S3 bucket policy in Account B to allow the role `ArchiveReaderRole` from Account A to execute read actions.
The bucket policy must authorize the external principal since default cross-account access is denied.
3
Determine KMS key policy changes.
Update the KMS key policy in Account B to allow the role `ArchiveReaderRole` from Account A to perform decrypt operations.
Since the bucket uses a customer managed KMS key for encryption, the caller needs explicit permission on the key policy to decrypt the objects during retrieval.

Key Concept

Cross-account IAM delegation requires explicit resource-based policy alignment (S3 bucket and KMS key policies) to authorize external principals.
Rate this question

Topics

IAM Policies and Roles

More questions from this topic