Examkin

Question

Difficulty: HardResolving IAM and Authorization Failures

A developer is troubleshooting an application running on Amazon ECS (using AWS Fargate) in AWS Account A. The application needs to retrieve objects from an Amazon S3 bucket in AWS Account B. The S3 objects are encrypted using a Customer Managed Key (CMK) in AWS Key Management Service (AWS KMS) located in Account B. The ECS Task Role in Account A has been configured with an identity-based policy that allows both s3:GetObject on the bucket and kms:Decrypt on the KMS CMK. However, when the containerized application runs, it receives an Access Denied error. Which two configuration changes must the developer make in Account B to resolve this authorization failure?

  1. Update the S3 bucket policy in Account B to grant s3:GetObject permissions to the Amazon Resource Name (ARN) of the ECS Task Role from Account A.Answer
  2. Update the KMS key policy in Account B to grant kms:Decrypt permissions to the Amazon Resource Name (ARN) of the ECS Task Role from Account A.Answer
  3. C
    Update the S3 bucket policy and KMS key policy in Account B to grant permissions to the Amazon Resource Name (ARN) of the ECS Task Execution Role from Account A.
  4. D
    Modify the ECS Task Role's trust policy in Account A to trust the S3 service principal (s3.amazonaws.com) and the KMS service principal (kms.amazonaws.com).
  5. E
    Update the application code to initialize the AWS SDK client using static credentials of a newly created IAM User in Account B that has full access to S3 and KMS.

Answer

To resolve the authorization failure, the developer must update the S3 bucket policy in Account B to grant s3:GetObject permissions to the ECS Task Role ARN from Account A, and update the KMS key policy in Account B to grant kms:Decrypt permissions to the ECS Task Role ARN from Account A.
For cross-account access to resource-based services that support encryption (like S3 and KMS), permissions must be configured in both the identity-based policy (the ECS Task Role in Account A) and the resource-based policies (the S3 bucket policy and the KMS key policy in Account B). Since the identity-based policies are already in place, the developer must update both resource policies in Account B to trust the ECS Task Role.

Step-by-Step Solution

1
Configure cross-account S3 access in Account B.
The S3 bucket policy in Account B is updated to allow the principal ARN matching the ECS Task Role in Account A.
For cross-account access, permissions must be granted on both the identity (ECS Task Role) and the resource (S3 bucket policy).
2
Configure cross-account KMS key access in Account B.
The KMS key policy in Account B is updated to allow the ECS Task Role from Account A to perform the kms:Decrypt operation.
AWS KMS requires that the key policy itself explicitly trust the external IAM identity; identity-based policies in the external account are insufficient by themselves.

Key Concept

Cross-account authorization requires explicit permissions on both the identity-based policy in the source account and the resource-based policies (bucket policy and KMS key policy) in the destination account.
Estimated Time:2m 0s
Rate this question

Topics

Resolving IAM and Authorization Failures

More questions from this topic